If you've been on the Internet for any length of time, the odds are excellent that you've received unsolicited email announcements and advertisements. These messages vary widely: one day you might receive information about a get-rich-quick scheme, the next an ad for an Internet service providerShow full article

Hide full article

If you've been on the Internet for any length of time, the odds are excellent that you've received unsolicited email announcements and advertisements. These messages vary widely: one day you might receive information about a get-rich-quick scheme, the next an ad for an Internet service provider. Some messages are controversial and pernicious, including political harangues and hate-filled diatribes. Others are just odd, such as an ad for hand-knitted kitty-boots, or (I'm not making this up!) an announcement that extraterrestrials from Saturn want to set up a bottle-cap recycling program in New Jersey.

Although the problem isn't new, the recent growth of the Internet has been accompanied by an explosive expansion in "bulk email" or "spam," and followed in recent months by an angry backlash. An entire industry is springing up around bulk email, and now the issues are headed for the courts. Although this article can't discuss every aspect of bulk emailing, it does provide some background, and explains how to respond reasonably to junk email.

Pros -- Since I'm personally inundated and annoyed by bulk email, I cannot claim to represent the viewpoints of those who send it. However, in discussing the topic with several people who condone bulk mailings, some rationales surprised me.

For the most part, bulk emailers believe they are providing a service by distributing information, thereby helping their recipients make informed decisions. In the United States, they believe their activities constitute free speech. Internationally, bulk email seems to be viewed as free enterprise that could only be curtailed by international trade agreements - agreements which, if they existed, would be nearly impossible to enforce. Further, in the U.S., bulk emailers feel the Internet is a public resource (since it was created in part with taxpayer monies), and that an email address is a matter of public record, like a street address. Many bulk emailers argue their activities should be encouraged since they're an "improved" form of postal advertisements: they can be better targeted, take less time to deal with (mail messages can be deleted in a few seconds, and no physical object needs to be transported), and have less environmental impact, since no paper and little fuel is used to deliver them.

Almost universally, bulk emailers believe their activities are justified. Further, some are selective with their mailings, sending only 50 or 100 highly targeted messages. Some also work hard to prune their mailing lists of addresses or whole domains that object to their mailings.

Of course, many are much less conscientious, holding contempt for those who take issue with their activities, or arguing (often effusively) that objecting to bulk email is nothing more than economic, technological, and cultural elitism. There are also a few bulk emailers who are new to the Internet and seem to have no idea their actions might be problematic.

A few bulk emailers also make an interesting point: users who most strenuously object to bulk email tend to have been on the Internet for a few years, whereas new Internet users seem to have far fewer objections to bulk email. And here's another surprise: unless a recipient actively objects to receiving a message, even the most conscientious of bulk emailers usually interpret that message as a success. They choose to believe that while the recipient may not have been interested in the material in that particular message, that recipient did not object to receiving it, and is thus a reasonable target for future mailings.

Cons -- The arguments against bulk email are numerous and well-known; I'll only summarize a few here. First, unlike postal mail, most Internet users pay to receive email at a flat rate, timed, or per-byte basis, so in many cases unwanted email is literally paid for by the recipient. Further, since the cost of bulk email is considerably lower than the cost of sending advertisements via postal mail, bulk email can be more easily abused and arrive in considerably higher volumes. Bulk email is also far more likely than postal advertisements to be inappropriate or personally offensive, not to mention in violation of state or local legislation. An argument can even be made that repeated targeting by bulk emailers constitutes harassment.

The most common objection to bulk email, however, is the annoyance. Most Internet users consider bulk email to be irritating and one of the Internet's largest drawbacks. They may feel that unsolicited mailings violate their privacy or interfere with their effective use of the Internet.

Perhaps the worst-case scenario is a bulk mailing gone bad. It's possible for a poorly-conducted bulk mailing to deliver thousands of copies of a message to a single account. Another troubling case is a mailing (or the backlash from a mailing) which overwhelms an Internet site or forces it to go offline. Events like these are widely considered to be attacks on individuals or entire sites, and usually provoke hostile and resource-consuming responses, potentially impacting untold thousands of Internet users.

The Spam Industry -- During the last two years, businesses and software products built around the bulk emailing concept have sprung into existence. Beginning with commercial endeavors by expert spammers who would sell themselves as hired guns to spread a message as widely as possible, the bulk email arena has lately been dominated by programmers and entrepreneurs looking to make a quick buck. Some write programs that collect email addresses or that can perform bulk mailings to thousands of people in a few hours. Others collect and sell mailing lists, and still others offer complete bulk mailing services, setting up Internet sites as bulk email clearinghouses. Many of these endeavors are visible and public, and at least one is being taken to court.

Bulk emailers get your address using a number of methods:

• Usenet trawling: Many bulk emailers use programs that scan all available Usenet newsgroups for email addresses, compile comprehensive lists, then remove duplicates. This is also used to create targeted mailing lists; for instance, a bulk emailer may assume that anyone posting in the comp.* hierarchy must be interested in computers. Similarly, geographically-specific lists can be created from Usenet groups related to cities or regions. Though scanning Usenet is an arduous task, any respectable computer can pull out thousands of addresses an hour. Ironically, services like AltaVista and Deja News make this process even easier for bulk emailers.

• Provider-trawling: Although this tactic is most often applied to online services like CompuServe or America Online, bulk emailers use programs to scan member directories and discussion forums to generate lists of users of online services. Bulk emailers wanting to generate a list of users at large Internet providers (like Netcom or EarthLink) may sign on using a trial account, then use directory listings or programs like Finger to generate lists of valid usernames.

• Mailing list trawling: Bulk emailers also scan large and popular mailing lists for email addresses. This tactic works best on large lists where lots of email addresses appear in the text of messages.

Collectively, these processes produce thousands of mailing lists, many of which overlap significantly. Removing your address from one doesn't remove it from the others, and your address can easily be re-added. Some bulk emailers do handle list removals responsibly; however, overwhelmingly, these lists merely grow.

What Can I Do? -- Unfortunately, there is no sure-fire way eliminate bulk email. As the problem gets worse, you can expect services to appear offering spam-free email accounts, and email filtering software will become increasingly sophisticated. In the meantime, the most effective way to stop bulk email is to make your objections known:

• Reply to the sender of the email, saying that you do not wish to receive such mailings, and that you object to such activities. If the message offers a way to remove yourself from a list, use it. Many addresses that bulk email appears to be sent from are forged, so be aware these messages may bounce.

• Examine the headers of the message to determine the site where the message originated. (This information is usually in the bottommost "Received:" header line.) Although this information can be forged, it's usually more useful than the names of intervening sites. Write a mail message to the username "abuse" or "postmaster" at that site, with a brief, polite note, the full headers of the message you received, and the message itself. Try to leave the subject line intact. This is the text I use to reply to junk email:

"I received the following unsolicited bulk email ("spam"), which apparently originated from your site. Please take appropriate action to ensure this doesn't happen again."

Although you may not receive a response to these messages, Internet providers usually a warn a bulk emailer that the activity should stop. If the mailings continue, the provider will usually terminate the account.

• Some Internet providers and online services have local email addresses or newsgroups where you can report bulk email messages. With enough information, the provider can then handle the matter for you. Check your provider's or online service's help system or customer service information.

In the event you receive bulk email from an Internet domain specifically set up to send bulk email, these tactics are likely to fail. If you're familiar with utilities like Whois and Traceroute, you might be able to identify that site's upstream providers and complain to them, but that's too detailed to discuss here.

The Future of Bulk Email -- The current inability to stop bulk emailers has led to calls for regulation, perhaps by modifying existing laws applying to the postal service or fax machines. Although the issues are very complex, here in the United States, communications law experts I spoke with generally agreed existing legislation would adapt poorly to email, particularly in the case of laws designed to prevent junk faxes. Of course, legislation passed here would be difficult to enforce within the country and wouldn't apply elsewhere.

The first court cases regarding bulk email are getting underway now and will be watched closely by the online community. No matter what the outcome of these cases, the success of bulk emailers is likely to spawn services geared to eliminating bulk email. Already, there's talk of building live, authenticated filters into email clients - every time you checked your mail, your mail program would check for a new set of anti-spam filters set up by your provider or perhaps by a subscription-based service anywhere on the Internet. With a small editorial staff and decent connectivity, providing frequently updated bulk email filters isn't a technological challenge.

In the meantime, if you're one of the few who likes bulk email... I know where you can get some great hand-knitted booties for your cat.

Hide full article

MARK/SPACE, INC: If you have a smartphone, we can sync it!
Sync your address book, calendar, notes, music, pictures, and
more from your BlackBerry, Windows Mobile or Palm OS mobile
phone to your Mac. <http://www.markspace.com/bits>

Suppose you belong to a simple lakefront beach club, where you and some neighbors jointly contribute dues to maintain the beach and docks. Now suppose that, several times a day, a rapidly moving caravan of several thousand vehicles zoomed across the beachShow full article

Hide full article

Suppose you belong to a simple lakefront beach club, where you and some neighbors jointly contribute dues to maintain the beach and docks. Now suppose that, several times a day, a rapidly moving caravan of several thousand vehicles zoomed across the beach. "Hey!" they might shout as they zoom by. "We're not using your beach; we're just passing through!"

This is what unsolicited commercial email (UCE, or spam) does to the Internet service providers (ISPs) that form our Internet beach clubs. Spam threatens the enjoyment of our pockets (and packets) of serenity by subverting resources paid for by ISP subscribers.

Such subversion comes in two forms: spam sent directly to you, where you waste time and effort downloading and deleting it; and spam that passes through your ISP's mail server on its way to some other poor sucker. (The mail server is technically called a Mail Transfer Agent, or MTA, whether it's Unix sendmail or a QuickMail SMTP gateway.)

This second problem is less discussed. A spammer can send outgoing spam through any mail server they choose - unless the mail server is secured against this, and relatively few are. This hijacking of a mail server clogs it up and invites retribution from people receiving the spam who incorrectly identify the innocent mail server that delivered it as the source of the offending mail.

It's possible for server administrators to prevent relaying and dramatically reduce spam delivery, although they can't close the door entirely.

In NetBITS-003, Adam discussed how individuals can deal with spam, including deleting it, reporting it, and supporting legislation against it. This article instead concentrates on solutions at the mail server side, which can apply equally to small offices or big ISPs. You can suggest these alternatives to your ISP if you're getting too much spam - if they implement any or all of them, expect service to improve and spam to decrease.

What Mail Is All About -- Here's a quick lesson in how email works. When you send mail, a short set of transactions takes place between your mail client (like Eudora or Netscape Communicator) and an SMTP (Simple Mail Transfer Protocol) server, which accepts the mail and later delivers it to the recipient's SMTP server.

The SMTP transaction consists of three basic commands which tell the server who sent the mail and who should receive it, and then the body of the message. The MAIL FROM command has the return address which starts the process; the RCPT TO header has the recipient's address. A DATA header follows, after which the contents of the mail message are sent, ending with a single period on a line by itself. The mail headers you're probably familiar with from reading the tops of your messages - like Received:, Reply To:, and X-Sender: - are actually inserted by the mail server into the body of the email message. They don't have anything to do with the process of sending or receiving mail.

A simple transaction looks like this (the server responses are in square brackets):

 [220 spaghettini.shlomo.com ESMTP Sendmail 1.0/1.0; Mon, 13 Oct 1997 10:06:19 -0700 (PDT)]
 HELO nebula.frogstar.boombox.com
 [250 spaghettini.shlomo.com Hello nebula.frogstar.boombox.com [192.0.0.1], pleased to meet you]
 MAIL FROM:<fredericks@hollywood.com>
 [250 <fredericks@hollywood.com>... Sender ok]
 RCPT TO:<glenn@fragmentarycomments.com>
 [250 <glenn@fragmentarycomments.com>... Recipient ok]
 DATA
 [354 Enter mail, end with "." on a line by itself]
 X-Hello: Hi there!
 Comments: I am not an authenticated user.

 Hope you eat your weight in ice cream today.
 .
 [250 KAA19936 Message accepted for delivery]
 QUIT

The reason it's so easy to spam people is that neither the MAIL FROM nor the RCPT TO headers are confirmed by a mail server beyond verifying (and even then only rarely) that the domains themselves exist. There's no login procedure for accounts that want to send mail. And, because the mail headers are just text the server inserts, they can be forged just by typing the text in after DATA.

So sending mail from <santaclaus@northpole.org> is a matter of connecting to the mail server, typing MAIL FROM:<santaclaus@northpole.org>, RCPT TO:<somebody@nowhere.com>, DATA, and then your text. Some mail headers can't be changed, notably the topmost Received: header, but there are ways to make it seem like mail originated from the forged address and then passed through other servers before coming to you.

That's the first part of the problem. The second is that MTAs actually "relay" mail between servers; they don't deliver it unless the address is "local." When you send mail from your local email client, the mail server first analyzes the RCPT TO address and does one of two things. If the address is local - a user who has a mailbox on that server - the MTA uses a Mail Delivery Agent (MDA) to add the mail to a mailbox. The mailbox is generally a file to which the MTA can append more information. This is true for Unix mailboxes (generally accessed via POP, or Post Office Protocol) and also proprietary systems like QuickMail, Microsoft Exchange, and cc:Mail.

If the address in RCPT TO isn't a local mailbox, the MTA acts just like a mail client and connects to another mail server that receives mail for the RCPT TO domain. It then repeats the transaction of MAIL FROM and RCPT TO. This process is relaying - your email client sends the message to your mail server, which in turn relays the message to another mail server that receives the recipient's mail. This usually involves only your mail server and the recipient's mail server. In rare cases, mail can go through several intermediate relays if the servers on either end are in large organizations or aren't connected to the Internet full-time.

Spammers subvert this process by using your mail server without permission. They specify your SMTP server as their outbound server and send mail to it; the SMTP server accepts the mail and then tries to deliver it. So, if a spammer can connect to the Internet at all, he or she can just appropriate time and space on any SMTP server.

Fortunately, users don't have to just sit back and be spammed. Let's take a look at possible solutions that you, your company, or your ISP can try.

Turn Off Relaying for Non-Local Users -- At least a million machines are running some kind of mail server or delivery agent, and sendmail V8 (also called 8.x) is the freeware Unix MTA program of choice. Some simple rules can be added to its configuration to prevent users who don't connect from previously specified addresses or domains from sending mail to users other than those to whom the mail server can deliver locally. In other words, your ISP can prevent anyone but local users from sending mail through its SMTP server.

Point your ISP to, or take a look at, the Web page below, which is a highly technical (but hopefully readable) counterpart to this article that I've aimed at those who implement these kinds of solutions. With an hour of work, any sendmail V8 configuration can be secured. There are also other resources which are referenced on this page.

<http://www.glenns.org/sendmail.antispam.html>

Systems running MTAs other than sendmail should have options to allow connections only from specific addresses as well. Often, this restriction is turned off by default. If the mail package your company or ISP uses doesn't allow this restriction, the ISP or your company might rethink the choice of MTA or lobby the vendor for this feature. Qualcomm's latest beta of Eudora Internet Mail Server for Macintosh and Eudora WorldMail Server for Windows NT 4 both support filtering, though the Mac server is currently more flexible. The popular commercial Post.Office mailserver from Software.com for Windows NT and Unix offers relay filters starting with version 3.1.

<http://www.eudora.com/betas/eims2.html>
<http://www.eudora.com/worldmail/>
<http://www.software.com/products/Post.Office/ PO31-WhatsNew.html>

Removing relaying can cause problems, however. A few months ago, the large ISP EarthLink Network turned off relaying for users who weren't dialed into their network in an effort to reduce spam. However, many people use EarthLink for email while at work, and they were cut off from sending email via EarthLink's mail servers. Retrieving email still worked, because it's secure: you must use your password to retrieve your email through a standard POP server. Of course, these users could use their companies' SMTP mail servers, but many companies have policies restricting use.

The benefit of eliminating relaying is enormous, though. Any site that spammers employ to relay mail can suffer twofold: first, from the added and unexpected gush of incoming spam mail that could slow down or crash a mail server; and second, from retaliation - many spam victims look at the last relay as the source of the spam and react by sending, say, 1,000 huge files or other "email bombs" in an attempt to take down the mail server. I don't condone such retaliation, in large part because it's usually misdirected at innocent by-servers.

Netcom, another large ISP, in a recent reply from their Internet abuse department, told me that they were still experimenting with what they called a "spam trap" to stop relaying. When Netcom stopped allowing non-Netcom addresses to use their mail servers, the servers bounced four million messages per week. Netcom then tackled users who bought accounts from them and spammed using other people's servers; three million messages per week were captured through this method.

Build Site-wide Spam Filters -- Spam can be rejected from specific IP numbers, domains, and email addresses. AOL pioneered this technique, although it's hard to tell whether it works. The sendmail filters noted above enable the mail server to bounce mail back to its return address automatically (with or without a custom bounce message, like, "We hate spam") instead of delivering it to local users.

Adam and I disagree over the utility of this kind of filter slightly, as he notes in his article last issue. Spammers are growing more and more clever, and usually forge return addresses uniquely each time. But spam filters can easily exclude "legitimate" spammers, like Cyber Promotions, which doesn't make any attempt at disguise. It's still difficult to identify and delete mail from <do.not.reply@nowhere.site> because the next time they'll masquerade as someone else, but I believe it's still worth trying.

Filtering on IP numbers works better, because faked addresses are ignored. IP numbers can't be spoofed easily (especially in mail transactions) since they involve low-level protocols. However, spammers often set up slash-and-burn ISP accounts at major providers from which they can send spam before the ISP realizes and cancels the account. If you filter on an IP number range that belonged to a major ISP because of this, you could risk filtering out a vast quantity of legitimate email.

One particular sendmail switch only allows incoming mail from real domain names. However, not all sites on the Internet have domain name resolution set up correctly, and you can wind up losing mail from people without knowing it. If you ban them from sending you email, it becomes a Dilbert cartoon: how do they send you email telling you that?

Make Money Slow -- You can take back your time and energy and put it into other things - like enjoying the sun and surf from your newly quiet patch of Internet sand. Or maybe getting some work done.

[Glenn Fleishman has been using Internet email since 1988. He receives about 40 spams a day and manages to reject 35 of them without ever seeing their subject lines.]

Hide full article

VMware Fusion. The most seamless way to run Windows on your Mac.
Backed by nearly a decade of proven virtualization technology.
Try VMware Fusion today for free, or order online for only $79.
Visit: <http://www.tidbits.com/about/support/vmware-fusion.html>

All right, I'm angry. I'm fed up with spam (junk email, sometimes known as unsolicited commercial email), and I'm almost as fed up with the hopelessness of the current methods of stopping itShow full article

Hide full article

All right, I'm angry. I'm fed up with spam (junk email, sometimes known as unsolicited commercial email), and I'm almost as fed up with the hopelessness of the current methods of stopping it. I assume you're all familiar with spam - if by some stretch of luck you're not, you probably will be before long, especially if you post to Usenet or put your email address on a Web page.

We all saw the rise of spam coming: unlike paper-based bulk mail, spam is essentially free to send, and so purveyors of spam are happy with a response rate far lower than the standard 1 to 2 percent achieved by traditional direct response campaigns. Now, the spam problem is getting ridiculous, with no signs of abatement in sight. In the last two months, I've gotten about 250 individual pieces of spam. Sure, I have a well-known address, but that's a lot of spam, and it's increasing in volume all the time.

In this article, I'll examine the efficacy of some anti-spam tactics and technologies. In an upcoming issue, Glenn Fleishman will cover the upstream part of this problem - how to stop spam at the source and how to keep your own or your ISP's mail servers from being hijacked.

Delete -- The simplest method of dealing with spam is the Delete command in your email program. It probably takes a few seconds for you to recognize that a message is spam, and only a few more to delete the message. Even multiplied by the number of messages I received since I started counting, I would only have spent two or three minutes of those months dealing with spam. This technique also has the advantage of being familiar - we do exactly the same thing with paper junk mail. However - in the United States at least - we don't directly pay to receive paper junk mail, whereas we all pay in some form or fashion to receive spam. More concerning, what happens when the ratio of spam to real email flips, so we're getting 98 percent spam? The Delete command won't work so well then, and believe me, it's only a matter of time before that would be true.

Complaints -- You can also complain about spam. You can return nastygrams to the spammers, ask to be removed from their lists, and complain to the postmasters of the ISPs involved.

At this point, however, replying to spammers has an efficacy of about zero. Sure, you might hit a novice spammer at some point who doesn't realize that no good email ever comes from spamming, but that's an exception. Most spam is forged in such a way that there isn't a valid email address to which you can reply. This makes pointless the idea of replying with a note that tells spammers that the next time you receive spam from them, they'll owe you money.

Using remove features when offered sounds like a nice idea, but why would a spammer want to honor remove requests? After all, getting a remove request means that the recipient has a valid email address and actually read the message. To the scarred and twisted minds of spammers, that must mean that the person sending the remove request is a prime target for more spam. Replying to an email address in spam that actually works virtually always gets you added to more lists.

Of these ideas, complaining to postmasters (nicely) is the only tack that has any hope of succeeding. I wrote and used a KeyQuencer macro that actually did all of these things (it replied to the message with full headers, put the word "remove" in the Subject line, put abuse and postmaster addresses at the domain involved in the CC line, and typed a short and pointed note at the top of the message). In several months of using my macro, I got email from a couple of abuse addresses (most of the big ISPs were pretty good) thanking me for the information and saying that they had kicked the person off. Most of the time, though, there was no recourse, and all my messages either bounced or disappeared. I figure I had at best about a 2 percent success rate.

Filters -- What about using the filtering capabilities built into all good email programs, like Qualcomm's Eudora and Claris Emailer? All you have to do is identify common aspects of spam and then you can filter it all to the Trash, or (until you're confident of your filters) into another mailbox where any real messages caught by your filters can survive. If you don't have the time or energy to create your own filters, others have done so for Eudora and other programs.

<http://www.public.usit.net/nwcs/Spam/Spam.html>

Unfortunately, filters are problematic for several reasons, and although you're welcome to use them, in the long term they're simply not the solution.

• Most spam email has been forged anyway - how can you possibly hope to keep up with spammers who can just forge another address?

• Filtering on the Received lines in the message header fails if the spammer hijacks an SMTP server to force it to deliver the spam. It's far too easy to do.

• Filtering requires constant updates and constant vigilance to make sure real mail hasn't been captured accidentally.

• To filter email, you must first receive it, which means in essence that you're paying for it, either in money directly (not everyone has flat-rate Internet access) or in time or bandwidth.

• Filtering on the domains of network service providers (the most notable one being filtered is a company called Apex Global Information Systems or AGIS) casts far too wide of a net. For instance, it turns out that the first part of the IP address we had some time ago for our mailing list machine, 205.199.*.*, is the same as the first part of the IP address used by arch-spammer Cyber Promotions. People who thought they were being clever by filtering on the start of that IP address effectively filtered TidBITS out as well, causing us major headaches when we got the complaints about missing issues. Also, since it's so easy to hijack an SMTP server, filtering on IP addresses is just as doomed as any other technique. Cyber Promotions recently got kicked off this network by AGIS; they're threatening to build their own network - which would make them much easier to filter out.

<http://www.news.com/News/Item/0,4,14907,00.html>

ISP Filters -- Perhaps the problem should be pushed upstream, to the Internet service providers? After all, if they filtered the spam out before it hit our mailboxes, we wouldn't have to deal with it all.

Nice idea, but I think it's fatally flawed. After all, who's to say that ISPs can avoid filtering real email any better than you can? And if the ISP was doing the filtering, you'd never even know that email from some friend of yours was being caught by the filter. Besides, even if you're not receiving, and thus paying for, the spam, the ISP is. Why should an ISP want to pay to carry spam any more than you?

Glenn has a slightly different viewpoint on this and will discuss it in his upcoming article about stopping spam at the source.

Voluntary Restraint -- Spammers had talked about forming a voluntary organization, and the Internet Email Marketing Council (IEMMC) was formed under the aegis of AGIS to develop industry guidelines for unsolicited commercial email, establish lists of people who didn't want to receive spam, and monitor compliance. However, according to news accounts (see URL above), the IEMMC was allegedly thrown out of AGIS's headquarters at the same time AGIS discontinued service to three major spam companies. It's unclear what will happen next with the IEMMC. In any case, this idea was flawed from the start. Anyone who believes this kind of a proposal will stop (or even stem) the tide of spam, should look into the purchase of this very nice bridge I have for sale. It's just not logical - anyone can spam, and whether or not the industry group has good intentions, they can't stop others from spamming any more than anyone else can.

<http://www.iemmc.org/>
<http://www.agis.net/press26.htm>

Legislation -- The final and, I've come to believe, only effective method of stopping spam is by legislation. If sending spam is illegal, then spammers will be subject to civil penalties, which, of all the methods discussed so far, pushes costs back on the spammers rather than forcing all of us to bear the costs of being spammed. Unfortunately, all the bills currently introduced just allow victims of spam to recover damages; none of them actually turn the spammers into real criminals.

Keep in mind, we're talking about legislation in the United States. But since the U.S. represents the largest consumer market on the Internet, bills that ban spam here should have repercussions elsewhere, especially in places where electronic privacy rights are already more highly protected, such as the European Union. If these bills drive spammers outside the U.S., it will become even easier to filter those sites out completely - cutting them off from the Internet, effectively - until they agree to stop. Most Internet traffic in and out of the United States flows over networks owned by a few U.S. companies; these companies might face fines if they fail to block spam from international sources.

There are four anti-spam bills being introduced before the U.S. Congress. The most direct is by Representative Christopher Smith (R-NJ); the other three are by Senator Frank Murkowski (R-AK), Representative Billy Tauzin (D-LA), and Senator Robert Toricelli (D-NJ). The four bills (others may be on the way) are not equal; three focus on opting out, and Smith's focuses on opting in.

Opting out means you have to ask to be removed from a list, but your request must be honored or the sender will face civil penalties which you can collect from them. However, there could be thousands or tens of thousands of lists you'd have to opt out from. Opting in means that a company can't send you a single piece of email without your request or your setting up a documented business relationship with them.

A small clarification about U.S. civil and criminal law, too, for those of you fortunate enough to never have had to tangle with either: Criminal law covers crimes prosecuted by the government. These may be ridiculous, but the penalties involve fines, jail time, community service, and other court-imposed duties. Civil law governs individuals' and companies' actions against each other, in which the final settlement generally involves either injunctions or consent decrees (in which one side agrees to stop or start doing something) or civil penalties (in which one side wins a monetary judgement against the other). The bills below all involve civil penalties, which mean you personally could file suit against the offender and, if you can prove their violation of the act, get cash money. In the case of spam, thousands or even hundreds of thousands of individuals could file civil claims across the country against single companies. Failure to appear in response to a suit often means a forfeit and having to deal with court-sanctioned liens. Since spammers annoy so many people, their financial risk would be enormous.

Current Bills -- Let's look at the current anti-spam bills. Senator Toricelli's <senator_torricelli@torricelli.senate.gov> bill, to start with, makes a civil offense of any attempt to forge email addresses or create fake domains. Further, it requires that if you request to be removed from a list (opt-out), these requests must be honored. The civil penalties are $500 for sending mail to you after you opt out, and $5,000 for various forgeries or misuse of service provider resources. The bill doesn't provide for specifics of how fast you have to be removed from lists. It also doesn't specifically limit coverage to commercial email, so anonymously sent private email could be covered. It's possible that legislating private speech in this manner could be unconstitutional; commercial speech has always had less constitutional protection.

<ftp://ftp.loc.gov/pub/thomas/c105/s875.is.txt>
<http://www.senate.gov/~torricelli/>

Representative William Tauzin's bill is also an opt-out bill, but is exceptionally vague. It essentially says that spam might be bad, and that spammers should voluntarily join an organization that will create guidelines for the industry. It doesn't specify civil penalties, and only appears to recommend that spammers honor opt-out requests. The bill provides relief to spammers in that if they join the trade organization, they're exempted from most penalties if they follow guidelines the group develops.

<ftp://ftp.loc.gov/pub/thomas/c105/h2368.ih.txt>
<http://www.house.gov/tauzin/>

Senator Frank Murkowski's <email@murkowski.senate.gov> bill is problematic. It would require spammers to label spam and avoid forgeries so ISPs can filter the spam at the server. Murkowski's bill graciously gives large ISPs one year to set up such filters, whereas smaller providers get two years. There are other provisions: users can request to be removed from spam lists, and must be removed within 48 hours; furthermore, ISPs would be forced to terminate service to anyone using their network to send spam without the required labelling and identification information. Penalties would range up to $11,000. These penalties could apply to ISPs if they fail to meet the bill's requirements, too, which has ISPs a bit nervous - it's not quite the Communications Decency Act, but it's potentially a case of "killing the messenger."

<http://www.senate.gov/~murkowski/press/ EMail052197.html>
<http://www.senate.gov/~murkowski/ commercialemail/>
<ftp://ftp.loc.gov/pub/thomas/c105/s771.is.txt>

Unfortunately, Murkowski's bill forces the ISPs to pay for carrying the spam, not to mention the costs of setting up and maintaining software to do the filtering. The basic problem, though, is that Murkowski's bill is an "opt-out" system (I'm sure there are a few people who like to receive spam, but there are people who enjoy self-mutilation as well). Cyber Promotions, one of the largest of the spam companies, brags about having 9,000 customers. I really don't want to spend my days removing myself from every spam list around, especially when they can just be regenerated from new sources.

<http://www.cyberpromo.com/>

Representative Smith's bill is based on an amendment to the Telephone Consumer Protection Act 47 USC 227, the law that makes it illegal to transmit junk faxes and sets a fine of $500 per incident, payable to the recipient, and $1,500 per incident if it can be proven that the originator of the junk fax knowingly violated the law. The amendment resembles suggestions from CAUCE (Coalition Against Unsolicited Commercial Email), and would expand the law and the penalties to apply to junk email as well. The existing law has been tested, both in the real world and in court, and has been found both effective and Constitutional. Junk faxes are essentially unknown now because of it.

<http://www.house.gov/chrissmith/>
<http://www.law.cornell.edu/uscode/47/227.html>
<http://www.cauce.org/amendment.html>

I've read through all of CAUCE's material, and I find them to be realistic and level-headed about the entire situation. I strongly encourage you to go to their site and read their explanations of why they feel legislation is the only course of action remaining. Essentially, CAUCE recommends an "opt-in" solution, where the only commercial email you receive is that which you ask for. If you agree with CAUCE's stance, consider joining and helping to spread the word... through non-spam techniques, of course.

There are tons of anti-spam resources available on the Internet these days - here are a few that I've visited. Note that they may have different opinions or propose different courses of action than I have above. Take everything you read here and elsewhere with a grain of salt. No one has a monopoly on the truth or even the one right way.

<http://www-fofa.concordia.ca/spam/>
<http://www.cnet.com/Content/Features/Howto/Spam /index.html>
<http://www.csn.net/~felbel/jnkmail.html>
<http://spam.abuse.net/spam/>
<http://www.mcs.com/~jcr/junkemail.html>

Hide full article

VMware Fusion. The most seamless way to run Windows on your Mac.
Backed by nearly a decade of proven virtualization technology.
Try VMware Fusion today for free, or order online for only $79.
Visit: <http://www.tidbits.com/about/support/vmware-fusion.html>

Washington State Outlaws Spam -- According to a Seattle Times article, Washington State Governor Gary Locke last week signed into law a bill that aims to reduce unsolicited commercial email, better known as spam (see "Damn that Spam!" in NetBITS-003, or search for "spam" in the NetBITS search engine)Show full article

Hide full article

Washington State Outlaws Spam -- According to a Seattle Times article, Washington State Governor Gary Locke last week signed into law a bill that aims to reduce unsolicited commercial email, better known as spam (see "Damn that Spam!" in NetBITS-003, or search for "spam" in the NetBITS search engine). The new law, which takes effect in 90 days, makes it a violation for spammers to send email messages with forged return addresses, fake header information, or misleading subject lines. The law applies both to spam originating within the state of Washington and spam directed at people who the spammer knows, or has reason to know, are Washington residents. It also places the burden on the spammer to determine whether or not any given individual resides in Washington. People who receive such spam could collect up to $500 per message, and Internet service providers could collect up to $1,000. It remains to be seen how easy it will be to collect damages, but no matter what, the new law should create a possible economic liability to spam where none has previously existed.

<http://www.seattletimes.com/news/local/html98/ junk_032698.html>
<http://db.netbits.net/article/04488>

In related news, notorious spammer Cyber Promotions has settled the last outstanding lawsuit against it by agreeing to pay ISP EarthLink Network $2 million and to stop sending unsolicited email to EarthLink members. Previously, Cyber Promotions settled spam cases with AOL, CompuServe, and Bigfoot, and had its network connectivity terminated by AGIS. [ACE]

<http://www.news.com/News/Item/0,4,20010,00.html>

Hide full article

WebCrossing Neighbors Creates Private Social Networks
Create a complete social network with your company or group's
own look. Scalable, extensible and extremely customizable.
Take a guided tour today <http://www.webcrossing.com/tour>

[This article is currently unavailable.] Show full article

Hide full article

[This article is currently unavailable.]

Hide full article

Bare Bones Software's BBEdit 9.0 -- A burly upgrade introducing new
capabilities like Projects, non-modal Find and Multi-File Search,
editing in browsers, text completion, Scratchpad, new Ruby module,
better JavaScript, ObjC, Obj-C++, YAML <http://www.barebones.com/>

Nearly two years ago, I wrote an article in TidBITS-347 called "Those Bulk Email Blues," which outlined issues surrounding unsolicited commercial email ("spam"), and how to respond to those messages. Although much of that article remains relevant, times have changedShow full article

Hide full article

Nearly two years ago, I wrote an article in TidBITS-347 called "Those Bulk Email Blues," which outlined issues surrounding unsolicited commercial email ("spam"), and how to respond to those messages.

<http://db.tidbits.com/article/00863>

Although much of that article remains relevant, times have changed. Spam continues to increase: since 01-Jun-98, I've received nearly 800 spams, an average of more than 11 per day. Further, spammers frequently probe my network looking for mail servers to exploit - my servers are locked down, but occasionally I run a dummy server that reports attempted spamming back to the originating network (and laughs gleefully when it does so). I'm also a party in the TidBITS lawsuit to test Washington's anti-spam legislation.

<http://www.tidbits.com/anti-spam/>

Don't Be Complacent -- During the last two years, I've become convinced that failing to report spam responsibly contributes to the wider spam problem. By failing to report spam, Internet users send an implied message to network providers, and hence to spammers: "This message didn't bother me enough to report; therefore, it is acceptable." If Internet users want spamming to stop, they must send a consistent, explicit message: spamming is unacceptable. Users can send that message by working toward effective legislative and technological solutions, and by reporting spamming incidents.

The problem is how to report spam. Most spammers try to cover their tracks: they use bogus return addresses, insert false headers, and relay messages through unsecured mail servers. Nonetheless, it is possible to figure out where you should report most incidents. Doing so requires time and some knowledge - but, as with all things, the more you do it, the easier it gets.

Identifying the Server -- To report a spamming incident, you must determine what Internet server sent the spam message to you, which means looking through the message's Received headers. Ignore return addresses or From lines: they're easily forged. Received headers are typically grouped near the top of a raw email message and appear in a particular order: the topmost header is the most recent, and (in theory) the bottommost indicates the message's origin. Email messages always have at least one Received header.

The bottommost Received header may not always identify the originating system. Spammers often forge one or more Received headers to throw you off the trail, but they can't forge them all. Forged Received headers appear beneath any legitimate Received headers and are often obviously different.

The only guaranteed way to figure things out is to start from the topmost Received header and work down. Look for the first Received header that claims to have sent the message to the domain where you receive email. If you have an account with EarthLink, for example, look for the first header that mentions an EarthLink system. Here's a fictional header that points to a location on my network:

Received: from Fred (pointless.quibble.com [204.57.207.56])
  by smtp100.earthlink.net (8.8.8/8.8.8) with SMTP id MAA17789
  for <your_name@earthlink.net>; Sun, 9 Aug 1998 12:55:13 -0700

You can see the system smtp100.earthlink.net received a message from a machine calling itself "Fred," a name probably supplied by the spammer. However, EarthLink's mail server didn't blindly accept Fred's statement of identity and performed a DNS lookup, discovering that Fred's canonical name is pointless.quibble.com. (All Internet machines have at least one unique IP number; machines don't require any assigned name, but can have many names, only one of which is canonical.) EarthLink's mail server inserted pointless.quibble.com in the Received header along with the machine's IP number to make it easier to track the origin of the message. This is good - these days, mail servers at many responsible Internet providers tag messages in this manner. Now you know the message came to EarthLink from quibble.com, and that's probably where you want to send your spam report. Let's look at a more complex example:

Received: from pointless.quibble.com (pointless.quibble.com
  [204.57.207.56]) by smtp100.earthlink.net (8.8.8/8.8.8)
  with SMTP id MAA17789 for <your_name@earthlink.net>;
  Sun, 9 Aug 1998 12:55:13 -0700
Received: from Fred by pointless.quibble.com id QQfbjb05104
  Sun, 9 Aug 1998 12:54:34 -0700 (PDT)

Here we can see that a machine calling itself Fred connected to a machine calling itself pointless.quibble.com, which didn't do any checking on Fred. Then, pointless.quibble.com connected to EarthLink, which confirmed the machine's name and delivered the message to you.

This second instance is probably a case of "relaying," where a spammer found an exploitable mail server in the quibble.com domain. This particular server would be a spammer's dream because it doesn't identify the machine that sent the message in the first place. The administrators of quibble.com may not be involved with the spammer and may not even be aware their system was used to distribute spam. You still want to report the incident to quibble.com and strongly encourage them to disable relaying on their mail server. Unfortunately, there isn't enough information to track the spammer further; hopefully, quibble.com's mail server keeps logs that would enable its administrators to determine the spam's origin.

If any of your mail is forwarded to you from another address, you may need to ignore one or more topmost Received headers. For instance, all mail to <geoff@tidbits.com> is forwarded to me at quibble.com. The topmost Received line in spam to <geoff@tidbits.com> always says that quibble.com received the message from tidbits.com. But the TidBITS server didn't originate the spam; I need to look at subsequent Received headers to see what machine sent the message to the TidBITS server.

IP Numbers & Ranges -- Sometimes even a well-configured email server won't be able to look up a canonical name for the machine giving it an email message. A Received header might look like this:

Received: from 204.57.207.56 ([204.57.207.56])
  by smtp100.earthlink.net (8.8.8/8.8.8) with SMTP id MAA17789
  for <your_name@earthlink.net>; Sun, 9 Aug 1998 12:55:13 -0700

To report this incident, you need to figure out who's responsible for the IP number 204.57.207.56. First, try a DNS lookup yourself to see if the number has an assigned name. Many utilities will perform a DNS lookup. For the Mac, I recommend Peter Lewis's $10 Mac TCP Watcher or Peter Sichel's $20 IPNetMonitor, both of which also include traceroute tools.

<http://www.stairways.com/mtcpw/>
<http://www.sustworks.com/~psichel/products/ product_ipnm.html>

Looking up 204.57.207.56 should reveal pointless.quibble.com, which indicates that you should report the incident to quibble.com. But let's say no name turned up. Your next best bet is to use a Whois server to determine who's responsible for that IP number. The Whois protocol enables you to ask a network authority for information about domains, systems, and points of contact for Internet sites. Unfortunately, there is no central network authority for the entire Internet. The American Registry for Internet Numbers (ARIN) maintains a good Whois database for domains registered in the U.S.; I always try ARIN first. Other network authorities include the InterNIC, RIPE (for European domains), and APNIC (Asia Pacific). Services like Allwhois.com try to be comprehensive but are more useful for determining if a particular domain is available, rather than figuring out IP number assignments.

<http://whois.arin.net/whois/arinwhois.html>
<http://rs.internic.net/tools/whois.html>
<http://www.ripe.net/db/whois.html>
<http://www.apnic.net/reg.html>
<http://www.allwhois.com/>

You may have to check with several authorities before you find who's responsible for an IP number. You may also have better luck searching for a range of IP numbers using an asterisk ("204.57.207.*") than looking for a single IP number, although you'll need to be careful interpreting the results. Multiple searches are awkward via the Web; you can also use a dedicated Whois client to query the databases directly. On the Mac, try IPNetMonitor or Peter Lewis's $10 Finger, which can query Whois servers.

<http://www.stairways.com/finger/>

If you look up 204.57.207.56 or 204.57.207.* via appropriate Whois servers, you find Northwest Nexus, which is my upstream ISP. If you were to report a spam incident from my domain to Northwest Nexus, I'd be taken to task quickly. Not all providers are that responsible, however; if spamming persists from a domain or an IP number after you've reported a few incidents, you can use a Whois server to figure out who's upstream from the responsible party - usually AT&T, Sprint, UUNET, or another large network provider. Most high-level network providers have a low tolerance for spam, but may only be able to forward complaints to their customers, such as regional ISPs. In my experience, reporting spam to upper-level network providers is only moderately effective.

If you can't use Whois to figure out who controls an IP number, your last option is a traceroute utility. Traceroute essentially figures out the path that packets are taking between two Internet machines. This path should show you what sites are "closest" to the IP number that sent the spam. You could send spam reports to the domain indicated as "closest" to the IP number that sent the spam message. However, be aware that Internet routing is dynamic: although the specific path between two machines usually doesn't change from moment to moment, it can change at any moment. Machines near your target IP number may have nothing to do with the spammer or the organization responsible for the IP number. If you report a spam incident using data obtained from traceroute, do so politely.

How to Report Spam -- When reporting a spam incident, include the complete text and headers of the message you received: administrators need this information to verify the incident. A courteous, professional message is always more effective than a vitriolic rant. I begin my reports with this boilerplate text:

I received the following unsolicited commercial email ("spam") that was either sent directly by one of your users, relayed through a mail server on your site or network, or sent from a dialup pool or downstream network administered by your organization. I've enclosed the complete message below with full headers; please ensure this doesn't happen again.

Since I live in Washington State, my messages also point to information about Washington's anti-spam legislation and mention the per-incident damages Washington residents can try to collect.

Send spam reports to the username "postmaster" and, optionally, "abuse" at the domain you've determined is responsible for the spam. The postmaster address is almost universally valid for a domain; the abuse address is less common but is often set up as a reporting address for spamming incidents.

For best results, always report spam to an address at a domain, not to a specific machine. In the examples above, you would use <postmaster@quibble.com> rather than <postmaster@pointless.quibble.com>. If the spam originated from a site using a two-letter country code (such as .us) rather than a three-letter top-level domain (such as .com or .edu), the domain will contain at least three parts (reno.nv.us) rather than two (quibble.com).

Removal Services -- What about removal services listed in spam messages, or sites purporting to be "global remove" lists? Two years ago, I recommended these removal services, figuring that responsible bulk mailers (there are a few) will remove your name from their lists and irresponsible ones have your address anyway, so there's no harm in trying.

Today, I can't recommend any removal services. Although a few are legitimate, far too many are either non-existent or simply address-collection clearing houses. One instance I chased down turned out to be a sophisticated operation used by several spammers: they collected the removal requests, then sold the senders' addresses to other spammers as "fresh addresses."

Don't Just Take My Word for It -- The issues surrounding spam are often the subject of debate. Although this article contains technical information and tips, in the end it's just my opinion. If you're interested in learning more - including other opinions about responding to spam or current legislative and technology initiatives - some of the links Adam has collected regarding TidBITS's anti-spam lawsuit are a good place to start.

<http://www.tidbits.com/anti-spam/spam-info.html>

Will the techniques outlined here stop the flow of spam into your mailbox? No. Is reporting spam simple? No. But at least reporting spam appropriately is an alternative to complacency, and you'll have the satisfaction of hearing from providers who have shut down spammers thanks to your reports. For that alone, many people will thank you.

Hide full article

Bare Bones Software's BBEdit 9.0 -- A burly upgrade introducing new
capabilities like Projects, non-modal Find and Multi-File Search,
editing in browsers, text completion, Scratchpad, new Ruby module,
better JavaScript, ObjC, Obj-C++, YAML <http://www.barebones.com/>

On 14-Mar-2000, King County Superior Court Judge Palmer Robinson ruled Washington State's 1998 anti-spam legislation unconstitutional under the interstate commerce clause of the U.SShow full article

Hide full article

On 14-Mar-2000, King County Superior Court Judge Palmer Robinson ruled Washington State's 1998 anti-spam legislation unconstitutional under the interstate commerce clause of the U.S. Constitution, holding that the law is "unduly restrictive and burdensome" on businesses. Robinson dismissed with prejudice a case brought by Washington State's attorney general against an Oregon man using unsolicited email to promote a get-rich-quick package, and signed an order allowing the defendant to attempt to recover costs and legal fees. The attorney general's office has until 10-Apr-00 to decide whether to file an appeal; it's widely expected to do so.

<http://www.seattletimes.com/news/local/html98/ spam_20000314.html>

TidBITS also filed a lawsuit in July of 1998 under the same Washington State anti-spam law. Our suit has progressed far enough that it is not affected by Judge Palmer's ruling; we hope to be able to say more in the near future.

<http://www.tidbits.com/anti-spam/>

Washington's anti-spam law bans unsolicited commercial email messages sent to a Washington State email address or from a computer in Washington State which use misleading information in the subject line, use an invalid reply address, or attempt to disguise routing information. Spammers are deemed to know if an address is in Washington State if available information indicates a domain is located in Washington, or if the address is included in a registry of Washington State email addresses. Judge Robinson reportedly found the requirement that senders proactively identify Washington State email addresses too restrictive; however, to meet the conditions of the statute, messages must both misrepresent themselves and be sent to a Washington address or from a computer in Washington State. An out-of-state business that sends email to Washington residents is not subject to the anti-spam law so long as it doesn't misrepresent the subject, reply address, or routing information in the email - even if the message is unsolicited.

<http://www.wa.gov/ago/junkemail/>
<http://registry.waisp.org/>

At this point the case has no significance in terms of precedence, and legal experts and consumer advocates are widely disagreeing with Judge Robinson's dismissal. TidBITS joins them in calling for the state to appeal the decision to the Washington State Supreme Court. In the meantime, HR 3113, a federal anti-spam bill widely known as the Unsolicited Electronic Mail Act of 1999, passed the U.S. House of Representatives Commerce Subcommittee on Telecommunications, Trade, and Consumer Protection on 24-Mar-2000. If enacted as law, it would offer even greater consumer protections than Washington State's anti-spam law.

<http://www.cauce.org/pressreleases/pr- hr3113.shtml>
<http://thomas.loc.gov/cgi-bin/bdquery/z? d106:h.r.03113:>

Hide full article

Bare Bones Software's BBEdit 9.0 -- A burly upgrade introducing new
capabilities like Projects, non-modal Find and Multi-File Search,
editing in browsers, text completion, Scratchpad, new Ruby module,
better JavaScript, ObjC, Obj-C++, YAML <http://www.barebones.com/>

As the Internet has evolved to provide ever more opportunities to separate fools from their money, the number of people trying to do just that has also increasedShow full article

Hide full article

As the Internet has evolved to provide ever more opportunities to separate fools from their money, the number of people trying to do just that has also increased. It was not always this way. Many years ago when I had my first AOL account, I never received a single piece of unwanted email. When I last tried AOL I received over 20 unwanted solicitations every day, even though I never used the account for email.

What happened? Can we go back to those halcyon days of yore? Can we stop the deluge of unsolicited commercial email, also known as "spam?"

"What happened?" is an easy question to answer. More ordinary people began using the Internet. A few brave souls took the risk of using the new medium to hawk their wares and some appeared to become fabulously successful - though that appearance seldom matched the reality. Others wanted to get in on the action and get rich quick. Junk email was born, grew, and proliferated like a runaway cancer.

Can we go back to the halcyon days of yore? No. You can't go home again, you can't put the genie back in the bottle, and you can't stop folks from trying to sell you things you don't want.

Can we stop the deluge? We can do some things to make spam more tolerable. We can report spam, which requires technical know-how and a bit of work every each time you're targeted. We can also look for legislative solutions. Back in NetBITS-005, I pointed out that once we turn to the government to help us deal with the undesirable elements on the Internet, we open the door to (shudder) regulation of the Internet. That is exactly what is happening across the U.S. with spam - it is being regulated by an increasing number of states, and Congress is actively considering enacting federal legislation to address the subject.

<http://db.tidbits.com/article/05032>
<http://db.tidbits.com/article/04474>

We have now entered an era where many believe it is more desirable to have the government tell us what we can and cannot send across the Internet than to deal with the problems caused by unrestricted Internet use.

The Problem -- In 1997 there were no state or federal statutes in the United States that specifically addressed email or Internet advertising. Since that time several states have enacted statutes, and others have established commissions to study the issue and make recommendations to state legislatures. On the federal level, the Federal Trade Commission (FTC) has completed two studies on Internet email and marketing; these studies concluded that a serious problem exists and will increase with Internet use. Congress has considered multiple bills addressing the issue; although none have passed yet, it is likely only a matter of time before Congress presents a bill to the President for signature. The FTC reports are available online; see "Protecting Consumers Online," 21-Dec-99, and "Report to the Federal Trade Commission of the Ad-Hoc Working Group on Unsolicited Commercial Email," 1997.

<http://www.ftc.gov/opa/1999/9912/ fiveyearreport.htm>
<http://www.cdt.org/spam/>

The problem addressed by the FTC, Congress, and the state legislatures is known colloquially as "spam." It is known more formally as "unsolicited commercial email," or UCE. UCE generally takes the form of an advertisement for a service or product that is sent to Internet users just as flyers, coupons, and other solicitations are sent to regular postal customers. To spammers, email offers a way to target thousands or even millions of potential customers at virtually no cost. The spammer needs only a computer and an email account. With those tools, he can prepare a single solicitation and email it to dozens, hundreds, or thousands of people at a time by using a list of email addresses gathered from a variety of public sources, such as Usenet news and links on Web pages.

As personal use of the Internet increased, so did the number of people using email to advertise their products and services. Many users didn't like receiving these solicitations, particularly since a large number offer things such as pornography, sexual aids, and other items that many people find offensive. The recipients then responded with torrents of complaints directed back to the spammers, who rapidly found their own email accounts filling up not with orders, but with complaints and demands to stop sending solicitations. Most spammers therefore began to conceal their own email address, instead including phone numbers or obfuscated links to Web sites where the user could place an order.

UCE is different from postal "junk mail" in one important way: When a seller sends a flyer, he must pay for the paper, printing, envelope, and postage for each item (a real cost, even considering the significant discounts for bulk postal mail). By contrast, when a spammer sends a thousand email solicitations, he pays virtually nothing. The recipients, however, do pay for their Internet accounts based either on time spent online or amount of data transferred. Even users with flat-rate pricing pay for spam: their fees are based on estimates of the resources users will consume, so although spam may not result in direct additional costs to the user, it could cause flat-rate pricing to increase across the board. Either way, the user pays the cost of the UCE. According to 1998 estimates in the report to the FTC (see above), users were paying up to $2.00 per month just for UCE, in addition to the time spent replying to or deleting unwanted messages, or reporting abuses. Internet service providers (ISPs) were dedicating increasing amounts of resources and time addressing customer complaints. In addition, the UCE was taking up disk space on the ISP servers - sometimes to the point of forcing the server to shut down until the UCE was cleared out.

Stamping Out Spam -- Now that we know the problem, what can be done about it? In the next part of this article, we'll look at the myriad solutions proposed at the state and federal levels, and why government intervention may not be a panacea for the spam problem.

Hide full article

Microsoft's MacBU: Supporting Mac users with Office 2008.
Straighten up your Office with the latest updates to Word,
Excel, PowerPoint, and Entourage. Update today at Mactopia!
<http://www.microsoft.com/mac/downloads.mspx>

TidBITS has published a variety of articles about how to deal with unsolicited commercial email (UCE), more commonly referred to as "spam" (see "Responding to Spam" in TidBITS-442)Show full article

Hide full article

TidBITS has published a variety of articles about how to deal with unsolicited commercial email (UCE), more commonly referred to as "spam" (see "Responding to Spam" in TidBITS-442). As the pro