Peter Black's Freedom to Differ

Optus spam fine

The ACMA has fined Optus under the Spam Act 2003:

Optus has been slapped with fines of $110,000, the second biggest penalty ever issued under the Spam Act.

The Australian Communications and Media Authority (ACMA) has accused Optus of sending 20,000 electronic messages without accurate sender identification.

Optus says the messages promoted the OptusZoo entertainment service and the company assumed customers would make the link between the sender ID of 966 and its alphanumeric equivalent ZOO.

"Optus assumed that recipients of their messages would make the connection between 966 and ZOO," ACMA Chairman Chris Chapman said.

"However, this was not considered sufficient identification, as '966' could be used to represent any number of permutations on a telephone keypad."

The ACMA says it decided to issue the infringement notices because Optus did not adequately address the issue.

Read more here (from ABC News).  Read the ACMA's media release here.

Happy birthday

Spam turns 30:

Spam - the scourge of every e-mail inbox - celebrates its 30th anniversary this weekend.

The first recognisable e-mail marketing message was sent on 3 May, 1978 to 400 people on behalf of DEC - a now-defunct computer-maker.

The message was sent via Arpanet - the internet's forerunner - and won its sender much criticism from recipients.

Thirty years on, spam has grown into an underground industry that sends out billions of messages every day.

Statistics gathered by the FBI suggest that 75% of net scams snare people through junk e-mail. In 2007 these cons netted criminals more than $239m (£121m).

Statistics suggest that more than 80%-85% of all e-mail is spam or junk and more than 100 billion spam messages are sent every day.

The majority of these messages are being sent via hijacked home computers that have been compromised by a computer virus.

Read more here (from BBC News).

Broken email

The Observer looks at whether email is a broken business tool:

The deluge of email flooding workers' inboxes every day has become so overwhelming that it is now a 'broken business tool' in urgent need of fixing, companies have been warned.

The average employee spends an estimated 90 minutes to two hours a day wading through hundreds of messages, suffering interruptions and distractions with every ping from their PC or BlackBerry. Worldwide email traffic has now hit 196 billion messages a day, according to the research firm the Radicati Group, and is predicted to reach 374 billion per day by 2011.

Some organisations, such as worldwide accountancy consultants Deloitte and the publisher Cedar, have held 'No email days' to encourage staff to use the phone or talk to each other instead. But these are only stopgap measures.

'Email is a broken business tool,' said Jason Preston, new media manager at the Parnassus Group, a social media consultancy. 'There's been no innovation to separate the junk letters from the real ones.'

Read more here.

Twitter: "an idiot and spam-free zone"

The Guardian asks why there are no spam or trolls on Twitter:

Because it's rather like an RSS feed - you choose to read it - and nobody so far has worked out how to spam a feed.

Twitter, for those not in the know, is a collection of microblogs where people post their minute-by-minute thoughts and actions. Anyone can sign up and start posting "tweets", or updates. Your tweets can be made and viewed via Facebook or your mobile as well as via the website (twitter.com).

However, this is asymmetric, unlike Facebook, which requires you to confirm a friend request before they can see your status updates, which are the same sort of idea as tweets. On Twitter you can choose to follow anyone whose tweets catch your eye; and similarly, unless you limit your tweets only to your friends, anyone can follow you even if you choose not to follow them. Not everyone follows everyone who follows them. You follow?

Given the number of trolls, fools and idiots on the internet, Twitter is remarkable for being largely idiot-free, as blogger Russell Beattie points out. "Think about any other online community system ever created," he observes at tinyurl.com/2scblt. "All of them have had to deal with the core problem of idiots. Anytime a virtual group gets to a certain size, the morons come."

Spam usually comes in the form of email, and you can find your inbox full of emails from Twitter. But you can change the default setting, which emails you when someone starts following you, when you get a direct message from someone or when Twitter itself sends out a newsletter.

...

On the Twitter stream itself, you can in theory spam users, as Dave Winer notes on his Scripting News blog (tinyurl.com/36vjwz). The reply function means that "you can direct a message with a url to anyone as long as you know their username", he points out. However, unlike ordinary spam, you can block a user who insists on replying to you with offers to boost your penis size.

It's not just ordinary people out there, though. Businesses are Twittering, such as JetBlue, the US no-frills airline, which tweets on new routes and deals on airfares, but as Winer notes, you don't have to follow JetBlue or any other commercial Twitterer. The problem will come once someone works out how to reply to users on a large scale.

Until then, though, Twitter remains, pretty much uniquely on the web, an idiot and spam-free zone.

Read more here.

That's a lot of splogs

Wordpress suggests that one third of blogs are splogs:

Would you believe that about a third of blogs are spam? At least those are the numbers for Wordpress, according to Matt Mullenweg, the blogging platform’s founder. But think about how many spam blogs there are out there. You’ll find them in pingbacks, search results, and linking through spam comments. Is it hard to believe that about a third of blogs out there really are spam?

Read more here (from Mashable).

Just making sure that phishing is illegal

Techdirt questions why the US Senate is considering a law to make phishing illegal:

As the saying goes, when your only tool is a hammer, everything starts to look like a nail. The folks in Congress sure do an awful lot of whacking at various nails these days. The latest is a new bill in the Senate that seeks to outlaw phishing. One tiny point is important here: phishing is already illegal. So, really all this bill does is allow these politicians to claim that they took a stand to stop phishing. Except, it's actually worse than that. Not only will this bill not do anything to stop phishing, it will actually make life worse for plenty of non-criminals. That's because a part of the bill would outlaw hiding domain name registration information. Now, there are plenty of legitimate reasons for not wanting to reveal your info in the whois database -- but according to this bill, it won't be allowed any more. If you want to own a domain, you'll need to cough up your name, address and phone number to whoever wants it -- and they better be legit. If you provide false info, you'll also be breaking the law. So, it won't do anything new to stop phishing, but will make it much more difficult to own a domain anonymously. That's quite a nail.

Read more here.

Why phishing works

Rachna Dhamija, J. D. Tygar and Marti Hearst from the Harvard School of Engineering and Applied Science have published an academic paper explaining "Why Phishing Works".  Here is the abstract:

To build systems shielding users from fraudulent (or phishing) websites, designers need to know which attack strategies work and why. This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users. The authors first analyzed a large set of captured phishing attacks and developed a set of hypotheses about why these strategies might work. They then assessed these hypotheses with a usability study in which 22 participants were shown 20 web sites and asked to determine which ones were fraudulent. The study found that 23% of the participants did not look at browser-based cues such as the address bar, status bar and the security indicators, leading to incorrect choices 40% of the time. It also found that some visual deception attacks can fool even the most sophisticated users. These results illustrate that standard security indicators are not effective for a substantial fraction of users, and suggest that alternative approaches are needed.

Download the paper here.

Nick Hodge jokes "Our Benevolent Federal Government should Filter More"

Microsoft geek Nick Hodge may joke when he titles his post on the Labor Government's "clean feed" proposal, Our Benevolent Federal Government should Filter More, but in the post itself he mentions spam, Nigerian scams, phishing and identity theft to make this excellent point:

All of the above are illegal either directly in statute or in common law.

In none of the above cases can any Government provide a safe environment to all its citizens all the time. Just how far is our benevolent Federal Government willing to go to protect it’s citizens?

I’d prefer the Federal Government set up a division of Department of Foreign Affairs online ready to help out netizens as they travel to this unique universe, not just fearfully blocking. Use the technology to educate people.

Read the whole post here.

What's phishing?

TechCrunch's Michael Arrington reports on a phishing scam involving Facebook:

I’m not sure what the bad guys want with a bunch of Facebook user account credentials, but phishing scams seem to be hitting the site. Scott Fish notes that some users are seeing Wall posts that contain links to phishing sites to gather Facebook credentials.

An example message is:

lol i cant believe these pics got posted….its going to be BADDDD when her boyfriend sees these- http://www.facebook.com.profile.php.id.371233.cn

Note that the URL in the quote above, which leads to what looks like a Facebook sign in page, is not Facebook. So if you visit the site (don’t), DO NOT enter your Facebook credentials or any other personal information.

Only your friends can add Wall posts on Facebook, so any posts linking to phishing sites are either from hacked accounts or else people have added the phishing guys as a friend.

Read more here.

Cybercrime 2.0

The Washington Post pays tribute to those clever cyber-crooks:

The year 2007 may go down in the annals of Internet crime as the year when organized cyber criminals finally got serious about their marketing strategies -- crafting cyber schemes that were significantly more sophisticated and stealthy.

Security experts say criminals are increasingly trying to ensnare Internet users by lurking on familiar Web sites and using purloined data to craft scam e-mails that are more believable, and thus more likely to entice an unsuspecting user.

"The attackers are now following the same path that businesses have, in trying to advertise themselves in their own special way on the more popular Web sites," said Tom Liston, an incident handler at the Bethesda, Md.-based SANS Internet Storm Center and a senior security consultant with Intelguardians, a Washington-based Internet security consulting group. "They're doing exactly what every business tries to do, which is to find innovative ways get themselves out in front of as many eyeballs as possible."

Read more here.

More spam than legitimate email

Read/WriteWeb breaks the bad news:

Reasearchers at IDC predict that this year the number of spam messages sent will eclipse the amount of legit email correspondence for the first time ever, reports USA Today. Approximately 10.8 trillion spam messages will have crossed through inboxes in the past year, compared to 10.5 trillion legitimate person-to-person email messages. The numbers indicate that spam is a growing problem, despite the promise of better filtering technology.

"Two years from now, spam will be solved," said Bill Gates in 2004 addressing World Economic Forum in Switzerland. But 2007 will go down as the worst year yet for spam, a trend that has held for the past four years, according to Rebecca Steinberg Herson, vice president of marketing at Commtouch, an email security firm.

In an interview last month with USA Today, Gates reminded that though the volume of spam has increased, more of it is being deleted by spam filters. "Sure, there's a lot [of spam] out there, but software is deleting 99.9% of that anyway," he said, though Microsoft has revised that claim to 85% - 95%.

Read more here.

"Australia's Spam Legislation: A Modern-Day King Canute?"

Mark Bender analyses Australia's spam legislation in this research paper:

Bender, Mark R., "Australia's Spam Legislation: A Modern-Day King Canute?" (September 2006). Monash U. Department of Business Law & Taxation Research Paper No. 2 Available at SSRN: http://ssrn.com/abstract=916724

Abstract: This paper considers a number of aspects of Australia's recently introduced unsolicited commercial email (UCE or spam) legislation, the Spam Act 2003 (Cth). The magnitude and nature of the harm caused by the spam problem is outlined, as are the key provisions of the legislation enacted in an attempt to reduce spam. Observations are made as to some of the perceived shortcomings of the Act, and of lawmakers' approaches in general in trying to legislate against spam. The fundamentals of Australia's legislative approach are contrasted with those of the corresponding US legislation and some key distinctions drawn, notably the Opt-In/Opt-Out dichotomy, Australia having used the former approach, while the US used the latter. Some alternative approaches and suggested enhancements to the Australian legislation are also considered, including proposals by Bill Gates and Lawrence Lessig. Finally there is a summary of and some limited comment on the first case brought under the Australian legislation.

MP3 spam

I was surprised to read on Ars Technica about the rise and rise of MP3 spam:

As anti-spam tools and e-mail users become more sophisticated, spammers are turning to new mediums to get their unwelcome messages through filters and into inboxes. One of the more recent developments is spam with attached MP3 files. One security software vendor, MXSweep, is reporting that MP3 spam now accounts for between 7 and 10 percent of all spam being sent.

Anyway, it doesn't seem like a good idea:

The files are given innocuous-sounding names like elvis.mp3, oursong.mp3, smashingpumpkins.mp3, or coolringtone.mp3. The payload is disappointing: a voice recording touting the virtues of some corporate stock; in other words, it's pump-and-dump stock spam in a new format. It's also a dumb idea. The overlap of those gullible enough to click on MP3 files of unknown provenance and those willing and able to invest in a stock that they've never heard of is certainly minute. It's bound to be more of an annoyance than anything else and seems unlikely to result in the desired stock purchases.

Read more here

US tops the list of spam-offending countries

ZDNet News covers this latest report into spam:

The U.S. remains the world's biggest spammer, according to security firm Sophos, which on Friday released its quarterly report on the world's top spam-offending countries--dubbed the "Dirty Dozen."

The U.S. came in well ahead of its rivals, according to the report, being responsible for

28.4 percent of all spam

. South Korea was second (5.2 percent), followed by China (4.9 percent), Russia (4.4 percent) and Brazil (3.7 percent).

"It seems as though a major American spammer is arrested every other week at the moment but, despite these high-profile law-breakers being put away, the U.S. continues to relay far more spam than any other nation on the planet," Carole Theriault, senior security consultant at Sophos, said in a statement.

"This level of activity can't be attributed solely to the slick operations of a few cash-hungry criminals. The problem is there are thousands of spammers using many thousands of compromised zombie computers in the U.S.," Theriault said.

Read more here.

Microsoft, Hotmail and spam

Club Troppo's Nicholas Gruen acknowledges that "Microsoft is a remarkable company" but wonders why they can't find a better a spam filter for Hotmail:

I have a hotmail account which I no longer access much, but ... I clicked [in] to look at the 22 emails I had this evening. All spam.

Still it must be pretty hard for Microsoft’s software to tell that emails with subjects like ‘up the ass’, and ‘Asian cocksucker’ are spam emails. I don’t know about you but I’m always sending emails like that around.

In case you’re thinking I’m looking at the junk intray - there are apparently 16 emails in there that the spam checker caught. I wonder what they say? Call me old fashioned but I reckon the subject ‘deep anal fucking’ ought to raise a few suspicions.

So, so true.  Read the full post here.

Skype phishing scam

Over TechCrunch, Duncan Riley alerts us to a surprising phishing scam:

Why in the world would a scammer want my Skype details? I have about $12 AUD in credit, which I suppose could be used to make calls, but it hardly seems worth the effort.

Notably, Gmail did not pick the email up as being a scam.

I checked the html for the email: the alleged skype link goes to a page on cec-icmc.org that is set up to look just like a page from Skype.

A quick search on Google results in other instances of Skype scams, but I didn’t find one exactly like this. In context, I don’t use Skype Out that often and Skype occasionally sends emails telling me that I have to use Skype Out to maintain the Skype Out credit, along with my Skype In number. This phishing scam keeps to the similar theme, in that Skype legitimately does on occasion request account updates.

A word of warning to the many, many Skype users out there: don’t trust emails claiming to be sent by Skype. If you’re already smart to this: good for you.

Read more here.

Facebook takes action against "Black Hat" applications

From TechCrunch:

Some of the most popular Facebook applications are using highly questionable tactics to spread themselves virally. Users have noticed and complained, and Facebook took action today to put stop the most egregious behavior.

Read more here.  About time!  A good move by Facebook.

Parody spam

The Nigerian email scams annoyed one person enough to write a parody spam.  Read it here.

Spam!

Spam!: The life of a spammer is a clever character study of a typical spammer.  The Daily Reel describes it in this way:

Creator Casimir Nozkowski continues the "First!" trilogy with this character study of a typical spammer.  In three minutes, we are given a chilling glimpse into the self-delusion that enables a man to become a polluter of email boxes.  "Why call it spam? Why not call it veal?" asks this most virulent of Internet pests, before busting into some freestyle rap.

Read more here.  And now watch the video:

Combating phishing

Technology Guardian has a good summary of the various techniques being used to combat phishing.  Read it here.

Free the Spam King?

From Wired:

Last week, Seattle-based "spam king" Robert Alan Soloway was arrested and charged with fraud, money laundering and identity theft. He is facing up to 65 years in prison and a fine of $250,000. I'm not holding my breath expecting this arrest to stop the flood of junk e-mail I receive, however. Law enforcement cannot stop spam with periodic high-profile busts, or with sentences greater than those received by rapists or murderers. Unfortunately, there's no quick fix, and we should search for something other than these symbolic incarcerations.
...

Spam is a difficult challenge, but it's one we will not solve with Soloway's incarceration. We need a broader and more comprehensive plan that incorporates technology, private investigation and enforcement and public education. Otherwise we create more problems for e-mail users than solutions, while failing to stop the money flow. And we embarrass ourselves by punishing spammers more severely than criminals who physically hurt people.

Read more here.

Spam wars

Venkat Balasubramani explains why the last six months have not been particularly kind to the antispam community:

Late last year, the U.S. Court of Appeals for the Fourth Circuit limited the reach of both state and federal spam laws to e-mails that contain "material" falsity or deception. And last week, a federal district court dismissed a Can-Spam claim on the basis that the plaintiff, James Gordon--who was not a traditional ISP--did not suffer the type of injury envisioned by the law, and thus lacked legal standing to sue.

The court also signaled its intention to award attorney's fees. While the decision will likely have minimal effect on claims brought by traditional ISPs, it is sure to take the sails out of the cottage industry built around spam litigation.

Read more here (from CNET News.com).

Do Not Call Register

With the Do Not Call Register getting quite a bit of media attention this week (for example, see here), I thought I'd link to a short piece I wrote last year summarising the legislation.  You can read my summary here.

"MySpace: Who Tom Sued and Why"

The lawsuits against MySpace are well known, but Mashable has a fascinating post on who MySpace has sued:

We frequently hear that MySpace is being sued - most recently by parents - but MySpace has also taken action against plenty of users who are abusing the site.

MySpace has always offered a rich platform for small and large business to advertise with but several companies have had to face MySpace in court for their efforts. While co-founder Tom Anderson has been quoted encouraging promotion on MySpace, many users have taken this freedom too far. Be it from fake profiles or tidal waves of unsolicited messages the results are the same: degradation of the community and poor user experience.

The action action against “Spam King” Sanford Wallace is well known, but here are some other cases that went largely unnoticed in ‘06 and ‘07 (some resolved very recently) ...

Read the rest here (including copies of documents relating to the cases).

Temporary email addresses

Today I stumbled upon what seems to be a good way to minimise spam - provide a temporary email address when required to give an email address when signing up for websites.  There are a couple of sites that provide such a service:

• Guerrilla Mail provides you with disposable email addresses which expire after 15 minutes. You can read and reply to emails that are sent to the temporary email address within the given time frame.
• Spambox gives your more flexibility as it creates a temporary email address that will expire after the time period you chose (30 minutes, 1 hour, 1 day, 1 week, 1 month, 6 months or 1 year).  For the duration of that period, all the emails sent to this email will be transparently forwarded to your real email.
• My Trash Mail gives you the choice between temporary email and secure temporary email.

I also discovered a site that allows you to send secure anonymous email - Anonymous Speech - which as it is located in Japan is governed by Japanese law and allowed to delete customer data legally from its servers.

Internet threats

PC World tells you how to thwart the three biggest internet threats of 2007 - Internet Explorer, phishing and identity theft, and malware.  Read it here.

Spam targets our egos

The New York Times has an interesting article on how spam plays off our insecurities:

The spewing of spam over the digital transom has long been derided as an annoyance and provoked concerns about the insecurity of computer networks. But now some e-mailers and experts on psychology and technology worry that it is also having a more pernicious effect: insecurity for the recipient.

With worldwide volumes having doubled in the past year, and ever-more sophisticated spammers singling out computer users with particular interests or problems, it can serve as a constant reminder of what is lacking for those with fragile egos — whether a sinuous body or an eight-cylinder sex drive.

“How do they know I need to (fill in the blank)?” the recipient wonders.

Delete, delete, delete.

“It can affect your emotions and your level of stress,” said Jeffrey T. Parsons, a psychology professor at Hunter College, who has conducted research on sexuality and the Internet. “Once you get in a spam loop, you can get bombarded with these things four or five times a day, and that can definitely trigger insecurities and exacerbate ones that already exist.”

Read the rest here.

How to phish

PC World has the story of a do-it-yourself phishing kit found for sale online:

A software kit has been discovered for sale on the Internet that makes it possible for non-experts to set up and carry out sophisticated phishing attacks on large numbers of websites.

EMC's RSA division reports that its Anti-Fraud Detection Center (AFCC) found the 'universal man-in-the-middle phishing kit' being offered in a free demonstration version on a criminal forum monitored by the company.

The kit--said to have a user-friendly interface designed to help the nontechnical criminal--automates the programming needed to pull off a normally tricky man-in the middle attack on websites such as banks or e-commerce sites.

Read more here.

Introducing Rock Phish

Check out this intrigiung story from PC World:

The first thing you need to know about Rock Phish is that nobody knows exactly who, or what, they are.

Wikipedia defines the Rock Phish Kit as "a popular tool designed to help nontechnical people create and carry out phishing attacks," but according to security experts, that definition is not correct.

They say that Rock Phish is actually a person, or perhaps a group of people, responsible for as much as one-half of the phishing attacks being carried out these days.

Why should you care? Phishers try to trick Internet users into divulging sensitive information on phony Web pages made up to look like a bank site or an online shopping site. It's a type of attack that is becoming very lucrative. Research firm Gartner estimates that phishers will cost U.S. businesses and consumers a whopping $2.8 billion this year. The average take: $1244 per victim.

No one can say for sure where Rock Phish is based, or whether the group operates out of a single country.

"They are sort of the Keyser Söze of phishing," says Zulfikar Ramzan, senior principal researcher with Symantec's Security Response group, referring to the secretive criminal kingpin in the 1995 film The Usual Suspects.

"They're doing some pretty scary things out there," he adds.

Read about what Rock Phish are up to here.

Spam is back!

The New York Times reports that spam has doubled from last year:

Hearing from a lot of new friends lately? You know, the ones that write “It’s me, Esmeralda,” and tip you off to an obscure stock that is “poised to explode” or a great deal on prescription drugs.

You’re not the only one. Spam is back — in e-mail in-boxes and on everyone’s minds. In the last six months, the problem has gotten measurably worse. Worldwide spam volumes have doubled from last year, according to Ironport, a spam filtering firm, and unsolicited junk mail now accounts for more than 9 of every 10 e-mail messages sent over the Internet.

Much of that flood is made up of a nettlesome new breed of junk e-mail called image spam, in which the words of the advertisement are part of a picture, often fooling traditional spam detectors that look for telltale phrases. Image spam increased fourfold from last year and now represents 25 to 45 percent of all junk e-mail, depending on the day, Ironport says.

The antispam industry is struggling to keep up with the surge. It is adding computer power and developing new techniques in an effort to avoid losing the battle with the most sophisticated spammers.

It wasn’t supposed to turn out this way. Three years ago, Bill Gates, Microsoft’s chairman, made an audacious prediction: the problem of junk e-mail, he said, “will be solved by 2006.” And for a time, there were signs that he was going to be proved right.

Read more here.

Elaborate phishing scam

From PCWorld:

An antispam researcher has uncovered a phishing scam that uses computers belonging to both a medical transcription outsourcing company and the Government of Malaysia.

The scam was discovered by Bill Carton, an engineer based in San Diego who has spent the last ten years as a volunteer antispam activist, shutting down bulk e-mailers in his spare time. Carton received an e-mail Friday morning that purported to be from eBay's PayPal service.

It read like a standard phishing pitch: "It has come to our attention that your account information needs to be updated," the e-mail said. "If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service."

What was unusual, however, was the fact that the link in the e-mail was to a fake PayPal site hosted by servers in the Malaysian government's gov.my domain.

Hoax tsunami warning emails

The Attorney-General Philip Ruddock has issued this media release about a spam email containing a tsunami warning:

The Australian Government will request the removal of a website link thought to be responsible for spam emails warning of an impending tsunami.

The email claims to be from the Pacific Tsunami Warning Centre in Hawaii and suggests an earthquake has occurred and a tsunami is approaching Japan. The link is understood to lead to a Sydney company.

The Attorney-General, Philip Ruddock, said the email had been formatted in a similar way to official earthquake and tsunami warnings.

"This may be an irresponsible joke, but it is totally inappropriate because some people may become alarmed,'' said Mr Ruddock

"I can assure Australians that no such earthquake has occurred. We have now alerted the relevant authorities who can investigative the hoax warning.''

The Attorney-General said the only authority that disseminates tsunami warnings was the Bureau of Meteorology.

Emergency Management Australia, within Mr Ruddock's portfolio, is working with the Bureau of Meteorology and Geoscience Australia to enhance tsunami warning arrangements.

This includes the establishment of a $68.9 million Australian Tsunami Warning System funded by the Government following the devastating 2004 Indian Ocean Tsunami.

If anyone has received this email, could you please forward it to me.

ACMA v Clarity1 Pty Ltd

On Saturday I posted a short entry about the orders and relief granted by Justice Nicholson in Australian Communications and Media Authority v Clarity1 Pty Ltd and the ACMA's statement welcoming the decision (see here).  This morning the reasons for judgment became available online on Austlii.  Read the reasons for judgment here.  (Note that these reasons relate only to the orders and relief granted.  The reasons relating to whether the Spam Act 2003 (Cth) was breached are available here.  And my summary of those earlier reasons are avaialble here.)

The reasons judgment focuses on the appropriate pecuniary penalties to be awarded.  The ACMA submitted that the appropriate pecuniary penalties under s 24 of the Spam Act were with respect to Clarity1, $9.9 million and with respect to Mr Mansfield, $1.98 million.  At the other extreme, the respondents contended that with respect to Clarity1, $10 000 and with respect to Mr Mansfield, $2000.  Justice Nicholson notes at [3] that the ACMA acknowledged that the amount of penalty being sought against each respondent was substantial. However, the ACMA contended that the amounts are low in the context of the very high maximum penalty that the Court could impose under the Spam Act (the ACMA's amounts being only 10% of the possible maximum), and that the very high maximum penalties provided for by Parliament reflect the seriousness with which Parliament regards contraventions of the Spam Act.

In order to determine the relevant pecuniary penalties, Justice Nicholson looked at the relevant matters under ss 24 and 25 of the Spam Act:

• the nature and extent of the contraventions (at [19]-[28]);
• the nature of loss or damage resulting from the contraventions (at [29]-[31]);
• the circumstances in which the contraventions took place (at [32]-[33]);
• the financial position of the respondents and their capacity to pay (at [39]-[45]);
• the totality principle requiring the consideration of the appropriateness of the pecuniary penalty having regard to the totality of the conduct rather than simply by the addition of each individual contravention (at [45]-[49]);
• the specific deterrence of the respondents (see [59]); and
• the commercial realism of the particular circumstances of the matter (at [55]).

One difficulty Justice Nicholson noted was that the maximum penalties provided for in the Spam Act gave rise to "an unrealistically large penalty".  At [56]:

The unrealistic character derives principally from the quantum of penalty viewed in relation to the capacity of either respondent to pay and the need for general as well as specific deterrence. It is not just the total quantum of a pecuniary penalty which can provide the element of general deterrence. That quality derives from a consideration of the penalty in relation to the conduct giving rise to it and the financial capacity of the offenders. Where the financial capacity is not great, a lessor pecuniary penalty in value will derive its quality of general deterrence from its magnitude in relation to that capacity.

Feeling that the amounts put forward by the ACMA were "disproportionate to the commercial realities", "overly weighted in favour of general deterrence", and did "not appear to be constructed on any allowance of the new character of the legislation and the entitlement of the respondents to test their view of the effect of the legislation",  Justice Nicholson awarded a pecuniary penalty of $4.5 million against Clarity1 Pty Ltd and $1 million against Mr Mansfield.

Read the reasons for judgment here.

Phishers target MySpace

Phishers have found a way to use genuine MySpace accounts to trick users into disclosing passwords.  Read about it here.

Federal Court spam decision

Earlier this year in Australian Communications and Media Authority v Clarity1 Pty Ltd [2006] FCA 410,  Justice Nicholson of the Federal Court held that Clarity1 and its managing director, Mr Wayne Mansfield, breached the Spam Act 2003 (Cth) for sending unsolicited commercial electronic messages and for using harvested address lists.  Read my summary of the case here.

Yesterday, Justice Nicholson awarded a pecuniary penalty of $4.5 million against Clarity1 Pty Ltd and $1 million against Mr Mansfield.  ACMA welcomed the decision:

‘ACMA’s action in this case underscores its vigilant approach to the enforcement of the Spam Act and combating spam,’ said Mr Chris Chapman, ACMA Chairman. ‘Spam causes significant inconvenience to individuals and businesses: disrupts email delivery, clogs up computer systems, reduces productivity, wastes time, irritates users and raises the cost of internet access fees.’

‘This judgement provides a strong warning to Australian spammers that contraventions of the Spam Act can result in substantial penalties being awarded against individuals and organisations, ’said Mr Chapman.

‘ACMA has previously demonstrated its determination to pursue important matters vigorously, a determination that will be a key attribute in its continuing success across its broad regulatory responsibilities,’ he added.

Stay Smart Online

Yesterday the Federal Government launched the Stay Smart Online initiative.  Check it out here.

Cybercriminals turn to the home

The Age has a good report on the new focus of cybercrime:

The good news: Most big organisations such as businesses, government agencies and schools now have effective barriers against direct assault by cyberthieves.

The bad news: The black hats are redoubling their efforts to get inside home computers, where security is often weaker.

The most obvious result of this ugly trend is "phishing", where criminals send out emails that appear to be from PayPal, a bank or a credit card company, asking you to click a link in the message to "verify" your account information.

If you follow through, you arrive at a web page designed to look like the real thing. As soon as you enter your account number and password, your account is at risk of getting cleaned out.

Symantec, in its report, said it detected 157,477 unique phishing messages in the first half of 2006, a stunning 81 per cent increase from a year earlier.

Equally scary is the growth of "botnets".

Read more here.

Spamhaus appeals

Following on from this post about the Spamhaus project, Spamhaus has appealed the default judgment.  Ethan Preston comments here.

How safe are you online?

On Wednesday night on ABC Radio National, Australia Talks Back looked at how safe your money and identity is when online:

More people than ever before are using their computers to bank and shop online. It can be quick and convenient but have you ever wondered if that little padlock in the corner of your computer screen actually means anything when it comes to internet security? How easy it is for your identity - or your money! - to be stolen?

Listen to the audio here.

How to avoid spam

In The Age, Nicole Manktelow looks at how you can reduce the amount of spam you receive.  Read how here.

e360 Insight, LLC v The Spamhaus Project: default judgment against Spamhaus

Following on from this post about the Spamhaus Project, Ethan Preston has more analysis at eplaw.us:

There's substantial hue and outcry regarding the litigation between e360 and Spamhaus before the Northern District of Illinois (my own backyard). There also seems to be substantial confusion over what exactly has happened. Despite reports to the contrary, the court has not ordered ICANN to suspend Spamhaus's domain name. e360 has submitted a proposed order that would have the ICANN-approved registrar "suspend or place a client hold" on the spamhaus.org domain name.

Nonetheless, the sitation is serious for Spamhaus and, consequently, for the rest of us.

Read the rest of the analysis here.

Spamhaus Project contempt order

From NetWorkWorld:

U.S. court threatens Spamhaus with shut down

By Robert McMillan, IDG News Service, 10/09/06

A U.S. court has threatened to shut down the Spamhaus Project, a volunteer-run antispam service, for ignoring a $11.7 million judgement against it.

In a proposed court order dated Friday Judge Charles Kocoras of the U.S. District Court for the Northern District of Illinois calls on the organizations responsible for registering the Spamhaus.org Internet address to suspend the organization's Internet service. Both the Internet Corporation for Assigned Names and Numbers (ICANN) and Tucows, the Spamhaus.org registrar, are named in the order. The proposed order can be found here (PDF).

The proposed order follows a Sept. 13 ruling in which Spamhaus was required to pay damages and stop listing an e-mail marketing company called E360Insight in its database of known spammers. Spamhaus, based in London, has said that it ignored the judgment because it cannot be enforced in the U.K.

Though the order is not yet final and may be part of "the judge's gambit to get Spamhaus to come back to the table," there is nothing to prevent it from ultimately being finalized, said Matthew Prince, CEO with Unspam Technologies, and an adjunct professor of law with the John Marshall Law School, writing in a blog posting.

"In other words, there may be some time before ICANN is formally ordered to shut down the Spamhaus domain, but make no mistake ... ICANN's lawyers will be considering their options," he wrote.

...

If ICANN does shut Spamhaus down, it could be bad news for e-mail users. Spam now makes up about 90 percent of all e-mail and Spamhaus reckons that it helps block between 8 billion and 10 billion of these messages per day.

Spamhaus's spammer blacklist is used by several technology vendors including Microsoft.

Spamhaus could not be reached for comment, but the organization has said that it intends to appeal the ruling. "The Illinois ruling shows that U.S. courts can be bamboozled by spammers with ease, and that no proof is required in order to obtain judgments over clearly foreign entities." Spamhaus said in a note on its Web site.

"Spamhaus is, however, concerned at how far a U.S. court will go before asking itself if it has jurisdiction, and is intending to appeal the ruling in order to stamp out further attempts by spammers to abuse the U.S. court system in this way."

Read more here.

For analysis, see Tech Law Prof Blog here:

File this one under "oops."  The Spamhaus Project (Spamhaus.org) is a web site that blocks spam by blacklisting what it believes to be known spammers.  Many mail servers use Spamhaus lists to block traffic associated with those spammers.  Spamhaus is based in Britain.  So far, so good.

One of those alleged spammers, E360 Insight, decided that they should not be on a Spamhaus list, so they sued, and the case wound up in federal court in the Northern District of Illinois ... Spamhaus entered an answer to the complaint but essentially abandoned the proceedings after that point.  Most civil procedure students know that when you answer a complaint you have subjected yourself to the jurisdiction of the courts.  Even the D students.  The lack of any action by Spamhaus in this case resulted in a default judgment of $11.7 million.  Spamhaus seemed not to care believing that that U.S. court orders are unenforceable in the U.K., so there was no way E360 Insight could collect on monetary damages.  This is typically true when there is no property to seize to enforce the judgment. 

However, federal Judge Charles Korcoras proposed a contempt of court order pulling the Internet domain registration from Spamhaus, essentially shutting them down.  The Internet Corporation for Assigned Names and Numbers (ICANN) is based in the United States and, in theory, must follow court orders.  All of a sudden Spamhaus can use a little extra tea to swallow those crumpets.  Spamhaus seems to think that either ICANN or the court will rethink the order as it would unleash 50 billion spam messages per day that are now blocked by the organization.  Maybe, but it doesn't help Spamhaus to have pulled out of the lawsuit before it thought out the possible consequences.  Not everything of value is measured in money.  Courts have been aware of that for hundreds of years.  We shall see if the court will let slip the dogs of spam.  You won't need a blog to tell you if that happens.  Just check you in box.

Visit the Spamhaus Project website here.

The end of pop-ups?

From The Guardian:

Web surfers infuriated by pop-up advertisements have virtually killed off "interruptive" online marketing by voting with their computer mouse and clicking them away, a new report suggests.

Online advertising spending soared more than 40% to just shy of £1bn in the first half of this year, putting it on track to overtake press advertising by the end of 2006, according to research by the online marketing trade body the Internet Advertising Bureau (IAB). The figures echo reports that indicate the online sector is shrugging off a tough overall advertising market, which has hit ITV and larger radio stations in recent months.

Within the web advertising world, interruptive formats, including pop-ups, dropped by 9% from a year ago and are now worth only 0.7% of all online advertising spending.

Read more here.

Spam maker loses trademark bid

From CNet News.com:

Hormel Foods, which owns the trademark for the spiced-ham food product Spam, has failed in its attempt to register "spam" as a European Union-wide trademark when used to designate unsolicited e-mails.

Hormel attempted to register spam as a trademark when used to refer to "services to avoid or suppress unsolicited e-mails" and the "creation and maintenance of computer software; technical consultancy, particularly in combination with network services; (and) providing of expertise, engineering services and technical consulting services (related to junk e-mail)."

Hormel argued in an appeal to the Office of Harmonisation for the Internal Market (OHIM), the EU trademark body, that the general public would not immediately recognize the use of the word spam as pertaining to junk e-mail but would instead associate it with "a kind of spicy ham" food product.

OHIM disagreed and dismissed the appeal.

Read more here.

Guess what? Advertisers are watching you online

Today's Sydney Morning Herald has a good feature piece on how advertisers are watching and learning your online habits.  It's nothing new, but if you're not familiar with what they do, how they do it and what they learn as a result, it will come as a quite a shock.  So if you're interested, check it out here.

The week in review – what I could find that I’ve missed

As I said last night, there is no way I could attempt to blog about everything I missed in the last week, but here are some links to things that would have caught my eye were I well enough to scour the web in the way I usually do.  Although several of them are very interesting and worth commenting on in some detail, I can only do so much to catch up.

Australian News

Most importantly (I’m joking here … sort of) – the identity of David Tench was revealed by The Daily Telegraph – it is stage actor Drew Forsythe.  Read more here.  (Thanks for the heads up Matthew Hickey.)

The Australian reported that Mark Vaile has predicted that fine-tuning of media ownership laws will be required to quell the concerns of Nationals MPs over their impact in regional areas.  Read the story here.

The latest ACMAsphere is available here.

Information about the QUT moot teams competing this week can be found here.

IT News

Google celebrated their eight birthday yesterday!

On a different note, Google defied a Belgian court order to publish a ruling that prevents it from running summaries of news reports and links to articles in Belgian.  Read about this copyright dispute in the New York Times here.

A cardinal with a blog?  Read about it in the New York Times report here and visit Cardinal O’Malley’s blog, who is the leader of the Roman Catholic Archdiocese of Boston, here.

Australian IT reported that a group calling itself Hacktivismo has launched a web browser that promises to protect the privacy of internet surfers from "hostile governments" or "data thieves."  Read the story here and check out information about the browser, which is based Mozilla Firefox, called Torpark here.  (Thanks for the heads up Shane Connor.)

Also from Australian IT:

• ICANN to stay in US hands (read about it here).
• Google to stick with search as it focus – not content (read about it here).
• China has built its own version of an ultra-fast, next-generation internet network that promises to reduce the nation's dependency on foreign firms (read about it here).
• Ten has had talks with News Interactive about striking a digital alliance, which would be a very exciting development (read about it here).
• AOL plagued by a botnet army (read about it here).  And while on botnets, look at this very good graphic by The Washington Post: Building a Botnet.

Last week Australian IT also had a good report on phishing (and see my ALTA presentation on phishing from earlier in the year here).  The Age had an interesting report on phishing a few days ago too (read it here).

Commentary (by others)

Errol Simper on how media diversity will fade away if we ditch the Keating media rules.  Read it here.

Kim Weatherall had some interesting thoughts on the Exposure Draft and the Lexmark/Sylink issue and the interoperability issue.

From one side of the world to the other, Susan Estrich had a good piece on the Bill Clinton phenomena.

Media Issues in the US

The Motion Picture Association of America banned the Deliver Us From Evil movie trailer, citing issues with sexuality and children in a documentary about a pedophile priest.  Decide for yourself if that ban makes sense by watching the trailer here.

The US Senate has been holding hearings on the proposed federal shield law for reports - The Free Flow of Information Act 2006.  The Media Law Prof Blog covered it here.

The Federal Communications Commission revised the rules regarding broadcasters' obligations "to protect and serve children in their audiences".  Read the media release here.

A Democratic Senator laughed on FoxNews at the "Fair and Balanced" FoxNews slogan:

And now, a final link to check out

Finally, The Washington Post had a really interesting article on the copyright implications of plagiarism checkers.  Here is an extract:

When McLean High School students write this year about Othello or immigration policy, their teachers won't be the only ones examining the papers. So will a California company that specializes in catching cheaters.

The for-profit service known as Turnitin checks student work against a database of more than 22 million papers written by students around the world, as well as online sources and electronic archives of journals. School administrators said the service, which they will start using next week, is meant to deter plagiarism at a time when the Internet makes it easy to copy someone else's words.

But some McLean High students are rebelling. Members of the new Committee for Students' Rights said they do not cheat or condone cheating. But they object to Turnitin's automatically adding their essays to the massive database, calling it an infringement of intellectual property rights. And they contend that the school's action will tar students at one of Fairfax County's academic powerhouses.

Read the rest of the article here.

Anyway, I think that will do it for now …

ACMA announces it will move to stop "missed call" marketing

The Australian Communications and Media Authority released this media release on Friday:

ACMA moves to stop ‘missed call’ marketing

The Australian Communications and Media Authority has advised two companies alleged to have engaged in ‘missed call’ marketing that these marketing activities are likely to constitute serious and extensive contraventions of the Spam Act 2003. Following ACMA’s intervention the companies responsible have now stopped making these calls while ACMA’s investigations are undertaken.

‘Missed call’ marketing is the term that has been given to the practice of calling a mobile telephone for such a short period of time that the owner cannot answer the call. When the marketer disconnects the call, most mobile phones present a ‘missed call’ notification with the marketer’s number. The marketer intends that the owner of the phone will think that they have missed a legitimate call and ring the number back, in which case they hear a recorded promotional message.

‘This is similar to receiving email spam which includes nothing except a link to a website,’ said Nerida O’Loughlin, General Manager of ACMA’s Industry Outputs Division. ‘In many ways, it is worse, as the cost of marketing is shifted almost entirely to the target, and the method of communication is more intrusive.

‘ACMA has closely scrutinised the missed call marketing practice to determine whether it is in breach of the anti-spam legislation. We believe that it is, and would like to send a clear message to the public and the industry about the legality of this practice,’ she said.

In the first and most prevalent example of ‘missed call’ marketing, callers were told about a gift of mobile content that they could receive by calling a 190 premium rate number.

In a more recent example of this type of marketing, callers were advised of a mobile premium SMS-based dating service operated on a ’19’ number.

ACMA recommends that members of the public should be wary of calling back ‘missed calls’ from numbers they do not recognise.

Members of the public who have experienced ‘missed call’ marketing can lodge complaints on the ACMA website. Complainants are asked to include as much detail as possible, including the calling number, date and time of the missed call, and, if the complainant has rung the number, the content of the recorded message.

ACMA will not provide further comment on its ‘missed call’ investigation until it has completed this investigation.

Read more here.

Did they read it?

Check out this service - Did They Read It?  This is how their website describe their service:

Whatever happened to that email you sent? How long did it sit in someone’s inbox before it was opened? Or maybe they never got it? Was it even opened at all?

When you use DidTheyReadIt, e-mails that you send are automatically and invisibly tracked. The instant the recipient opens your message, DidTheyReadIt automatically notifies you.

Sounds pretty cool, right?

ACMA targets spammer

The Australian Communications and Media Authority released this statement today:

ACMA executes search warrant for alleged major breaches of the Spam Act

The Australian Communications and Media Authority has recently executed a search warrant on a residential premises in relation to an allegation that an Australian resident was sending billions of unsolicited commercial electronic messages, referred to generally as ‘spam’.

‘Preliminary analysis of the email messages contained in the spam campaign has identified that over two billion emails were sent in one spam campaign,’ said Lyn Maddock, Acting ACMA Chair. ‘ACMA analysis to date has identified that the messages in the spam campaign primarily promoted Viagra products.’

The investigation commenced after ACMA received information from OPTA, the Dutch Independent Regulator of Post and Telecommunications. ACMA is working closely with overseas agencies in its investigation.

While the spam being examined by ACMA in the current investigation appears to have been sent from overseas, section 7 of the Spam Act 2003 makes it an offence for an Australian to be involved in the sending of spam if there is an ‘Australian link’. As part of its investigation, ACMA is investigating whether there is an Australian link associated with this spam campaign.

ACMA is undertaking further analysis of the information obtained as a result of executing the warrant.

Penalties for contravention of the Spam Act can be up to $220,000 per day for first-time corporate offenders and up to $1.1 million per day for repeat offenders. Profits can also be forfeited and compensation paid to victims.

As the matter is still under investigation no further comment can be made at this time.

Spam can be reported and the SpamMATTERS reporting tool can be downloaded from the ACMA website.

Read more here.

Precision phishing

The Age has a story on the increasing sophistiction of phishing attacks:

Gangs of online criminals are masterminding ever smaller and more targeted attacks designed to convince you to hand over your security details or download malware such as viruses and trojans.

Peter Cassidy, co-founder of the US Anti-Phishing Working Group, presented these findings to the Australian Information Security Summit on Thursday.

He said that, a few years ago, only two or three main brands were targeted in email phishing attacks.

"These were typically really large international institutions and big e-commerce companies," he said.

However figures compiled for June revealed that 130 companies or brands were targeted during the month.

Read more here.