July 14, 2024

Archives for 2003

Spammers Concerned by CAN-SPAM?

Alan Ralsky, one of the biggest spammers, thinks the new CAN-SPAM act will hinder his spamming business, according to Saul Hansell’s story in today’s New York Times. Naturally, eventhing this guy says should be viewed skeptically, but the article is interesting nonetheless.

Mr. Ralsky talks a lot about himself in the article, and a revealing picture emerges. He has constructed a (rationalized) view of himself as a legitimate businessman who has been forced by those nasty antispam technologies to resort to practices like operating underground, forging mail headers, using open relays, and so on. Now the CAN-SPAM Act will ban some of those practices – and he wants us to feel sorry for him!

Mr. Ralsky also claims that he has been inactive (i.e., not spamming) for the past few weeks. I’ve been remarking to people for the last couple of weeks that there seems to be less spam than there was before. I almost wrote a blog entry asking all of you whether you had seen the same thing. Is it just the holiday season? Or is this one guy sending lots of my incoming spam?

Mr. Ralsky says he will soldier on, continuing to spam while complying with the new law. But he worries that his compliance will make it easier for people to filter out his messages. Let’s hope so.

RIAA Subpoena Decision, and Fallout

There’s been lots of talk about the DC Circuit court’s ruling that the RIAA cannot compel ISPs to identify customers who the RIAA suspects of infringing copyrights. The court ruled on narrow grounds, saying that Congress, in the text of the DMCA, did not authorize the type of subpoena that the RIAA wants to use.

This is good news, but it is not as big a deal as some people think. The subpoena provision in question was hardly the greatest injustice in the world. Yes, it was open to abuse by various bad actors; and yes, not everybody identified to the RIAA turned out to be an infringer. If I were king, I would not allow RIAA-style subpoenas without judicial approval. But unless you shed tears for the actual infringers whose names were revealed to the RIAA – which I don’t – this is not the huge privacy boon that some have suggested.

What happens next? One of two things. The RIAA may ask Congress to change the law, to allow the subpoenas in question. My guess is that Congress would give them what they want, perhaps with a few new safeguards to prevent the most egregious abuse scenarios. Alternatively, the RIAA may cut a deal with the major ISPs, in which the RIAA agrees not to ask Congress to change the law, and the ISPs agree in exchange to forward RIAA warning messages to customers who the RIAA identifies as probable infringers.

In the meantime, the RIAA says they intend to file John Doe lawsuits, in which they sue first and then use a traditional subpoena to identify the defendant.

More E-Voting Follies

Lately it seems that we’ve seen one story after another about the carelessness of e-voting vendors, especially Diebold. Here are two.

(1) Kim Alexander of the California Voter Foundation (who has been, in my experience, a reliable source of information) reported this:

This afternoon [apparently Tuesday – EF] I attended a meeting of the California Secretary of State’s Voting Systems Panel, which is in charge of certifying and decertifying voting systems for California elections.

At this meeting the initial results from the Secretary of State’s audit of counties using Diebold equipment were released. The Secretary of State’s auditors discovered that of the 17 counties using Diebold equipment (both optical scan and touchscreen), all 17 had some software or firmware version in use that was not certified by the Secretary of State.

It was an astonishing piece of information – no one knew how widespread the problem was of Diebold installing uncertified software in voting systems as was discovered in Alameda County. It turns out all of Diebold’s California clients are using some version of Diebold software or firmware that is not certified by the state.

It was a real bombshell. Secretary of State Kevin Shelley came into the meeting to address the panel and spoke very firmly and passionately about the need for voters to have confidence in elections. He also suggested that it is possible Diebold could be decertified in California altogether.

(2) An AP story by Rachel Konrad reported on allegations that Global Election Systems, a company purchased by Diebold, had employed convicted felons, some in upper management. Here’s a sample:

The programmer, Jeffrey Dean, wrote and maintained proprietary code used to count hundreds of thousands of votes as senior vice president of Global Election Systems Inc. Diebold purchased GES in January 2002.

According to a public court document released before GES hired him, Dean served time in a Washington correctional facility for stealing money and tampering with computer files in a scheme that “involved a high degree of sophistication and planning.”

Diebold said that Mr. Dean left his job when Diebold bought GES. Diebold apparently did not comment on the status of the other four current or past employees who are said to be convicted felons.

[Link credit for (2): Siva Vaidhyanathan.]

Do We Want a Do-Not-Email List?

The CAN-SPAM Act, signed into law yesterday by President Bush, will take effect on January 1. The Act asks the Federal Trade Commission to study whether a national do-not-spam list, akin to the much-loved do-not-call list, should be implemented. It’s an interesting question.

The crux of the problem is the danger that the do-not-spam list would become, in the hands of unscrupulous spammers, a who-to-spam list. We know that spammers pay money for lists of known-to-be-active email addresses. Surely, they would be more than happy to get such a list – and an unusually large and accurate one – from the government for free.

There are countermeasures, though. If we put some newly minted, fictitious addresses on the list, any mail sent to those addresses later must have involved misuse of the list. If we give out separate copies of the list to different spammers, we might put different fictitious addresses into each copy, so we can tell later whose copy was misused. Of course, spammers may collude and compare their copies to find the bogus addresses, so we want some of the bogus addresses to appear in multiple copies so that we have an idea of who to blame even if lists are combined. Figuring out how best to use duplicate bogus addresses for this purpose is a nice little exercise in theoretical computer science.

Some have suggested another approach, in which bulk emailers are given access to an “oracle” that will answer queries about whether a particular address is on the do-not-spam list. This could be done by providing an on-line service that answers queries, or by giving giving out cryptographic information (i.e., the cryptographic hashes of the addresses on the list) that allows address-by-address querying. In either case, the worry is that spammers will use the oracle to “purify” their address lists, by discarding addresses that aren’t on the do-not-spam list.

Another approach, perhaps ironically, is to provide a mailing service that will forward email to any recipient, except those on the do-not-spam list. Bulk emailers who used such a forwarding service would be able to send mail, via the service, to anybody who isn’t on the list, but they would have no easy way to test for membership of an arbitrary address on the list.

What’s the right answer? I don’t know. But I’m glad that we’re not rushing ahead with a list before we figure out how to do it or whether it’s a good idea in the first place.

Painters Buy White Canvases for a Reason

Wendy Seltzer (pointing to Ross Mayfield) quotes Verisign CEO Stratton Sclavos as saying, “We have to move the complexity back into the center of the network and remove it from the edge.” As even mid-level netheads know, this is the antithesis of the Internet’s design – the Internet approach is to put intelligence at the edge of the network. Here’s Wendy:

Painters buy white canvases for a reason. The Internet has succeeded as a platform for innovation because its architecture does not preempt its uses; instead, the stupid network offers a neutral background for line drawing, oil painting, and collage. Sure a grid on the blank canvas would help those making mechanical drawings at the right scale, but it’s just noise to the rest, who now need to paint an extra layer to cover it up. Complexity built into the network (such as a search engine that responds to every nonexistent domain name query [i.e., Verisign’s abortive stunt]) may enable a few uses, but it slows or breaks many more, and impedes the development of alternatives.

I’m not sure why Verisign thinks that its contract to perform certain administrative functions gives it a license to redesign the Net; but somehow it does. Just another reminder that the Net does need to be governed, if only to keep outfits like Verisign from fouling it up. Even ICANN looks pretty good at times like this.