Spam

This information is brought to you by DNS Seal, a best practices wiki for DNS

Spam is usually defined as "unsolicited commercial emails," frequently sent in bulk. Spam remains a frequent and troubling issue for many Internet users. A report released by McAfee Security indicated that August-September 2013 had a large spike in spam emails with just under 4 trillion messages detected. Social media spam specifically has increased in the first part of 2013 by 355% according to Nexgate's State of Social Media Spam Report.

• It is important to note that not all of what people consider to be spam is illegal and that spam can be used for legitimate advertising purposes, such as receiving email offers through online mailing lists.

Public Perception

Public perception on Spam ranges from viewing it as an irritating, yet inevitable, nuisance that comes with having an email address to a potentially dangerous threat to computer security. Spam has become such a large problem that it is addressed by law, making the activity of many spammers criminal.

Outcome

The outcomes of spam vary and include providing commercial offers, spreading malware, and enabling phishers to commit fraud and identity theft.

Historical Use

Spam can be used for a variety of purposes ranging from solicitation to criminal fraud and identity theft and accordingly, can vary greatly in content. Spam can be used to:

• Commit fraud, such as 419 Fraud, where a Nigerian official asks for monetary help in order to transfer money out of Nigeria and offers a large reward, or the more recent Hurricane Katrina Relief Fraud
• Perpetrate phishing scams by asking for personal or financial information
• Install and spread malware and viruses
• Create "zombie computers" or botnets controlled by hackers in order to send spam to more users and access private information
• Share legitimate advertising or commercial offers

ICANN Policy

ICANN does not have a policy directly relating to spam as the "content of an e-mail message, ftp file, or web page bear no inherent relation to the assigned domain name, and therefore fall outside of ICANN's policy-making scope." However, the use of WHOIS data to send spam is a violation of ICANN's Registrar Accreditation Agreement, and in this case, ICANN suggests contacting the offending registrar. A Security and Stability Advisory Committee (SSAC) study stated that "the appearance of email addresses in response to WHOIS queries assures spam will be delivered to these emails."

Legislation

• CAN-SPAM Act of 2003 (or the Controlling the Assault of Non-Solicited Pornography And Marketing Act): originally enacted by the U.S. government in 2003 and updated in 2008, the CAN-SPAM Act defines the boundaries of what constitutes legal versus illegal spam. Legal commercial emails will fit the following requirements:

1. "The header of the commercial email (indicating the sending source, destination and routing information) doesn't contain materially false or materially misleading information;
2. The subject line doesn't contain deceptive information;
3. The email provides "clear and conspicuous" identification that it is an advertisement or solicitation;
4. The email includes some type of return email address, which can be used to indicate that the recipient no longer wishes to receive spam email from the sender (i.e. to "opt-out");
5. The email contains "clear and conspicuous" notice of the opportunity to opt-out of receiving future emails from the sender;
6. The email has not been sent after the sender received notice that the recipient no longer wishes to receive email from the sender (i.e. has "opted-out"); and
7. The email contains a valid, physical postal address for the sender."

• It is important to note that this act only addresses commercial emails and does not address emails deemed transactional/relational or non-commercial. Additionally, fines up to $16,000 per spam email may be charged and guilty parties may even be subject to imprisonment if:
  • The spammer uses another person's computer or email to send spam without his/her consent or
  • If the spammer uses false information or domain names.

• The U.S. wire fraud statute: this legislation prohibits any fraud or deception that uses "wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice." It has previously been used to address computer crimes although it was not originally created for this purpose. There is also a special provision that addresses fraud cases that try to benefit from disasters or emergencies. Under this act, using email to send out fake Hurricane Katrina Relief spam could result in up to 30 years in prison or 1 million dollars in fines.

Additional Resources

• File an FTC Spam Compliant
• Forward spam emails to spam@uce.gov
• Read tips on How to Avoid Spam
• View the SSAC Study concerning the relationship between WHOIS Services and Spam

Related Articles

• Malware
• Phishing
• CAN-SPAM Act

Security and Stability Advisory Committee. Advises the ICANN community and Board on matters relating to the security and integrity of the Internet's naming and address allocation systems (ICANN Bylaws).