If I stay there will be trouble … If I go there will be double – Joe Strummer (1952-2002)

“We can be heroes, just for one day” - David Bowie (1947- ) 

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder.

We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Kreb’s fantastic ‘Security Fix’ blog on the Washington Post site. Written with both technical accuracy and readability ‘for the rest of us’, a rare thing indeed, Brian is the current raving-fav among the security set, due to his high profile, and willingness to call a spade a spade.

He has shone the spotlight of national media on some real embarrassments, situations like ICANN dragging their feet regarding the decertification of rogue registrar EstDomains (a service much-favoured by malware authors and spammers), (they are now offline), Atrivo, a California-based ISP which played a pivotal role in sustaining the Storm botnet, (they are now offline) and Krebs played a part in the latest victory for us good guys on the net, noting McColo was a host for botnet command-and-control technologies  (yes, they too are now offline!)

So why the ambivalence Neil? Good question! Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one’s pinky in a dyke, and there are days when I don’t even think we have a dyke! We’ve certainly seen dedicated anti-spam/anti-malware volunteers suffer from burn-out, and drop off, over the years, a loss to all of us as an Internet community.

CAUCE Executive Director Neil Schwartzman appeared on CTV Newsnet November 07, 2008

http://watch.ctv.ca/news/latest/spammed-out/#clip110343

This week, the Internet Engineering Task Force (IETF) published a number of what they call "RFCs," which originally meant "Requests for Comment" -- the standards documents which specify the technical underpinnings of the internet. Two of these, numbered 5321 and 5322, replace earlier documents defining the very core of internet email. On the surface, each of these seem surprisingly simple; one aims "...to transfer mail reliably and efficiently," while the other defines itself as "...a definition of what message content format is to be passed between systems." Yet without general industry-wide acceptance of (and compliance with) these standards, internet email simply would not exist.

This week also marks ten years since the death of Jon Postel, who arguably had more influence over the creation of the internet than any other single person. One of Jon's most enduring recommendations is to "be conservative in what you send and liberal in what you receive," which Vint Cerf (who had only slightly less influence over the early internet), described as "...a reminder that in a multi-stakeholder world, accommodation and understanding can go a long way towards reaching consensus or, failing that, at least toleration of choices that might not be at the top of everyone's list."

This philosophy is the root of all email, from the earliest standards discussions to the latest theories of authentication, reputation, and deliverability.

On Friday the Virginia Supreme Court threw out the state's anti-spam law, and with it the 2004 conviction of large-scale spammer Jeremy Jaynes, on the grounds of First Amendment overbreadth. While not disagreeing that Jaynes was guilty as charged and convicted, they found that the law could place too great a burden on non-commercial speech. CAUCE president John Levine commented in this blog entry.

While CAUCE is dismayed at this outcome, we see little practical effect beyond this single case. This case predates the Federal CAN SPAM law, which does not have the First Amendment issues of the Virginia law, which would clearly apply if Jaynes were to do the same things today he did in 2003. Nor do the other state anti-spam laws have similar overbreadth issues. CAUCE believes that it is possible to create more effective anti-spam laws than the weak CAN SPAM without running afoul of First Amendment issues and will continue to work to help pass them.

Earlier today Neil Schwartzman, the CAUCE Executive Director, did a series of interviews for the Canadian Broadcasting Corporation radio 'drive' shows. He focused on why Canada doesn't (yet) have anti-spam legislation, who is behind the spam we all receive, why and how laws will help, and how internet users can protect themselves. Here's a recording of one of the interviews, conducted by All Points West host Jo-Ann Roberts for the Victoria, British Columbia CBC Radio One station, reproduced with permission.