Reference:
---

Date: Tue, 21 Jan 2003 11:08:37 -0500
From: Rich Kulawiec
To: Declan McCullagh
Cc: Doug Isenberg , bzs@world.std.com
Subject: Re: FC: Can we stop Sen. Joseph Lieberman from spamming?

Oh, I'm gonna wade into this one with both feet. ;-)

On Mon, Jan 20, 2003 at 09:45:12PM -0500, Declan McCullagh wrote:
> You and your Politech readers may be interested in this analysis
> from the Duke Law & Technology Review: "Political E-mail: Protected Speech
> or Unwelcome Spam?,"

Posit: No such analysis is necessary: spam is NOT speech and therefore
all of the debate we could have over what kind of speech it is, what
protections it might or might not enjoy, etc. is irrelevant.

Spam is conduct: specifically, spam is conduct consisting of a
denial-of-service attack which may or may not be targeted at users,
systems, networks, mailing lists, or some combination of these,
sometimes in small but often in very large quantities.

One of the first people to clearly articulate this was Barry Shein (who
I've CC'd on this so that he might correct me if he feels I'm taking
his comments out-of-context or otherwise mis-reading their intent):

Denial of Service Attacks disguised as Spam
http://www.cctec.com/maillists/nanog/historical/9801/msg00014.html

What he said several years ago is even more true today, as examples
show up on a daily basis.

"Vanilla" spam (i.e. spam which does not have forged headers, does
not hijack open relay or proxies, etc.) is similar to other forms
of abuse which take resources that are made available for use in
moderation and abuses them by excessive use. In that sense, it's
closely related to abuses such as ping flood attacks, article
"floods" posted to Usenet; exhaustive downloads of large FTP archives;
and other activities. It doesn't make illegitimate use of resources:
it makes excessive use of resources -- which it is a denial-of-service
attack and should be treated as such.

"Sophisticated" spam (i.e. spam which uses forged headers, asymmetric
routing, hijacked relays, hijacked proxies, and so on) compounds this
by making illegitimate/unauthorized use of resources that belong neither
to the sender nor the putative recipients. The legitimate owners and
users of those intermediate systems are secondary victims of this
attack, as they are also deprived of service, often to a large degree.

Three examples:

1. One of my mail servers endured a sustained attack from a spammer's
system last week. That remote box, which I traced back to an IP address
in Japan, made more than 11,000 unsuccessful attempts to stuff unwanted
traffic into mine. (It did this overnight; when I woke up in the morning,
I firewalled off the originating address.)

But I still have to pay for the bandwidth that was used: that system
is on a burstable circuit whose pricing structure is a flat fee plus a
surcharge for additional traffic. And -- in case you're wondering --
there's not the slightest question that it was spam: the only user
account on that machine is mine, and it has never emitted a single
mail message, so it couldn't possibly have signed up for anything.
(The server exclusively handles mailing list traffic for a number of
volunteer/non-profit organizations.)

2. I blocked all traffic from the well-known spammers at azoogle.com
nearly a year ago. My mail servers return the correct response codes to
every SMTP connection from them, indicating that access has been permanently
denied; the text message which accompanies it indicates why. However,
they're still pounding away multiple times per day, every day, on every
mail server I have. A small sample of abridged log entries from the
last 24 hours:

Jan 19 16:49:03 sendmail: arg1=transport23b.azoogle.com,
arg2=66.197.140.226, reject=550 5.0.0
Jan 19 17:23:41 sendmail: arg1=transport23e.azoogle.com,
arg2=66.197.140.229, reject=550 5.0.0
Jan 20 09:06:19 sendmail: arg1=transport12c.azoogle.com,
arg2=66.197.140.72, reject=550 5.0.0

I have 12,814 more log entries just like that in my archives.

3. A few months ago, a spammer conducted a "dictionary" attack against
a domain that I host. This means that they attempted delivery of their
messages to:

abc@example.com
abcd@example.com
abcde@example.com
[...]
a.smith@example.com
b.smith@example.com
c.smith@example.com
[...]
asmith@example.com
bsmith@example.com
csmith@example.com
[...]
joe@example.com
mary@example.com
jim@example.com

for a very large number of probable usernames. I let this one go --
because it was on a circuit with extra bandwidth and was directed against
a mail server that was otherwise idle, and because I was curious to see
how long it would go on. When it was done, several million individual
delivery attempts had been made -- from a couple thousand different IP
addresses, meaning that the spammer(s) had also abused thousands of other
systems while abusing mine,-- and probably others: I doubt my system was
the sole target.

[ end examples ]

This happens every day, all day. Spam-monitoring/tracking forums like
the spam-l mailing list and Usenet newsgroup news.admin.net-abuse.email
have a constant stream of reports like this. (And would have more if (a)
more admins were aware of them (b) more admins were aware of what's being
done to their systems/networks and (c) more admins could spare the time.)

My mail servers now reject more spam than they deliver mail. This,
sadly, appears to be the trend. I am compelled to spend my time and my
money attempting to stave off the abuse: I will probably need to pay
additional charges for more rack space in the 1-3 months in order to
install a proxy SMTP host/firewall and, of course, I have to purchase
the machine, configure it, pay for the bandwidth it uses, etc.

And this is because -- unfortunately -- spam is NOT correctly treated as
a denial-of-service attack, with all the ramifications that this implies,
but is instead confused with the normal use of email for personal
correspondence, ordinary mailing list traffic, order confirmations,
and the thousand other legitimate uses of the SMTP protocol.

So while I find free speech debates interesting (a) because I took
a couple of Constitutional law courses and now occasionally make the
mistake of thinking I understand something and (b) because I value
free speech highly and once put my job on the line to defend it, I don't
think they're in the least bit relevant here: to go back to my
opening statement, spam is conduct, not speech.

---Rsk




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
Declan McCullagh's photographs are at http://www.mccullagh.org/
-------------------------------------------------------------------------
Like Politech? Make a donation here: http://www.politechbot.com/donate/
Recent CNET News.com articles: http://news.search.com/search?q=declan
-------------------------------------------------------------------------

Politech

Notes:

Reference:
RDC's sole purpose is to extract and amass "risk relevant" information out of more than 15,000 public sources from around the world, including government databases and news media. The result is a constantly growing uber-database that assists banks in weeding out bad customers from the good.
Toronto Star

Notes:

Reference:
A three-day meeting that brought together Asian governments, organizations, companies and non-governmental organizations (NGOs) ended Wednesday morning with the approval of a declaration that, among other things, calls for encouraging the development of open-source software. A draft of the declaration had called for open source to be "supported" but was changed after objections from the U.S. government delegation late Tuesday night.

The U.S. opposition was largely perceived to be support for its domestic software companies and in particular Microsoft, said officials from other governments on the sidelines of the conference on Wednesday.

....

"The digital divide unfortunately is widening," said Kim Hak Su, the executive secretary of the United Nations Economic and Social Commission for the Asia-Pacific and the U.N.'s highest ranking official in Asia.
InfoWorld

Notes:
How about the digital divide between the Palladium countries and the non-Palladium countries? see Ross Anderson's Palladium FAQ

Reference:
Almost nobody studies the history of U.S. foreign policy. That's a shame: A little historical perspective may not win converts to Bush administration policies, but it will reduce fears that the United States has become a rogue superpower. What we have seen since Sept. 11 is an example of the dynamic interplay among four schools of thought that have shaped U.S. foreign policy for more than 200 years. That history tells us something about both the new direction in American policy and its longer-term limits and consequences.

In my recent book, Special Providence, I called these schools Jacksonian, Hamiltonian, Wilsonian, and Jeffersonian. The battles within the Bush administration and between that administration and its domestic critics reflect these old divisions and fault lines.
....
Jacksonians, populist patriots named for Andrew Jackson, represent the U.S. foreign policy tradition of conservative, hawkish unilateralism that other countries fear. ... Jacksonians -- including most white Southern Protestants -- are the core of President George W. Bush's domestic support. He cannot fail their tests of leadership and toughness.
....
Hamiltonians say that U.S. strength is grounded in economic might and globalism, much like British power in the 18th and 19th centuries. The United States, today's Britain, will need a complex, long-term and pragmatic strategy to maintain international peace and will have to work closely with other countries to achieve it.
....
A third group, the Wilsonians, believe like their hero Woodrow Wilson that the United States should promote a just and democratic world order. They're now split on war with Iraq. Liberal Wilsonians believe in working through international institutions, such as the United Nations, come what may. Conservative Wilsonians support democratization and liberalization of the Middle East and are willing to use force to end human-rights violations in the region.
....
Jeffersonians have opposed U.S. wars against Mexico, Spain and Vietnam; they support civil liberties and oppose crackdowns on unpopular minorities and dissidents in the name of wartime security. In a Vietnam-type situation, where the United States faces a long war with no victory in sight, Jeffersonian opposition can be effective. Otherwise, Jeffersonian war protests are eloquent but have little impact on U.S. policy.
....
Overshadowed by the war crisis, Hamiltonian policies already play a large role in the Bush administration. Relations with Russia and China have been pragmatically managed, despite calls from Jacksonian hawks to confront these countries more aggressively. After some Jacksonian sabre-rattling, the administration has shifted to a pragmatic, multilateral approach to North Korea ...
....
No school ever gets all it wants. Jacksonians are riding high after Sept. 11, but the other schools are still in place. And the checks and balances inherent in the U.S. system place tight limits on how far the Jacksonians can go.

Globe and Mail

Notes:

Reference:
Predictability is a pressing need in the software industry. Business experience, sometimes undermined by client pressure, has not been able to regularly provide adequate accuracy in cost and schedule estimates. The problem is compounded by the complexities and interdependencies of software development, which operate outside the human genetic disposition towards linear thinking.
....
However, as the complexity of systems rises, the ability to use linear (i.e. not geometric) approximations decreases rapidly.
Software Genome Council

Notes:

Reference:
Faced with growing pressure from constituents concerned about the risks of identity theft, lawmakers are contemplating ways to curtail use of Social Security numbers for purposes other than taxpayer identification.
Wired

Notes:
Interesting take. Goes contrary to the idea of digital dna/universal unique identifier to facilitate tying numerous databases together.

Reference:
Most of the arguments around the RIAA-vs-MP3 debate hinge on issues of copyright, intellectual property, Absolute Moral Truth, and so forth. None of this is necessary or particularly enlightening. The issues are simple, clear-cut and well understood matters of economics.
K5

Notes:

Reference:
According to a statement released by a committee of data protection registrars from each of the 15 European Union member states, Microsoft agreed to "a radical change of the information flow" and other changes to better protect consumers' addresses, ages, phone and credit card numbers and other personal details.

"Users' data will now be better protected," said Frits Bolkestein, the union's commissioner for internal market issues, who was an observer at the committee's meetings this week.

The changes that Microsoft agreed to make are intended to let consumers know which information about them is available to commercial Web sites and to make it simpler to restrict that data.
NYTimes

Notes:

Reference:
To me, it makes much more sense to audit and restrict the use of intelligence than to try to stop the intelligence agencies from connecting the dots. But you sound so much more hip and cool if you label as fascism any attempt by government to be organized and competent at fighting terrorism.
Kling

Notes:

Reference:
The Internet has encouraged a great deal of idiotarian demagoguery. Net-heads complain about "Big Media" which supposedly controls "content," keeping it away from the "commons." Once again, transactions that are based on Market Pricing are re-interpreted as Authority Ranking that detracts from Communal Sharing.
....
The Internet has encouraged a great deal of idiotarian demagoguery. Net-heads complain about "Big Media" which supposedly controls "content," keeping it away from the "commons." Once again, transactions that are based on Market Pricing are re-interpreted as Authority Ranking that detracts from Communal Sharing.
Kling

Notes:
When Big Media uses its monopoly position to affect directly Authority Ranking through lobbied legislation, then it is not solely a matter of Market Pricing at play. It's too bad that so many smart economists, apparently believing that economic thinking is more highly evolved than the rest -- Communal Sharing, Authority Ranking, and Equality Matching -- become so enamored with Market Pricing that their worldview shrinks to a monocular focus.