If I stay there will be trouble … If I go there will be double – Joe Strummer (1952-2002)

“We can be heroes, just for one day” - David Bowie (1947- ) 

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder.

We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Kreb’s fantastic ‘Security Fix’ blog on the Washington Post site. Written with both technical accuracy and readability ‘for the rest of us’, a rare thing indeed, Brian is the current raving-fav among the security set, due to his high profile, and willingness to call a spade a spade.

He has shone the spotlight of national media on some real embarrassments, situations like ICANN dragging their feet regarding the decertification of rogue registrar EstDomains (a service much-favoured by malware authors and spammers), (they are now offline), Atrivo, a California-based ISP which played a pivotal role in sustaining the Storm botnet, (they are now offline) and Krebs played a part in the latest victory for us good guys on the net, noting McColo was a host for botnet command-and-control technologies  (yes, they too are now offline!)

So why the ambivalence Neil? Good question! Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one’s pinky in a dyke, and there are days when I don’t even think we have a dyke! We’ve certainly seen dedicated anti-spam/anti-malware volunteers suffer from burn-out, and drop off, over the years, a loss to all of us as an Internet community.

CAUCE Executive Director Neil Schwartzman appeared on CTV Newsnet November 07, 2008

http://watch.ctv.ca/news/latest/spammed-out/#clip110343

On Friday the Virginia Supreme Court threw out the state's anti-spam law, and with it the 2004 conviction of large-scale spammer Jeremy Jaynes, on the grounds of First Amendment overbreadth. While not disagreeing that Jaynes was guilty as charged and convicted, they found that the law could place too great a burden on non-commercial speech. CAUCE president John Levine commented in this blog entry.

While CAUCE is dismayed at this outcome, we see little practical effect beyond this single case. This case predates the Federal CAN SPAM law, which does not have the First Amendment issues of the Virginia law, which would clearly apply if Jaynes were to do the same things today he did in 2003. Nor do the other state anti-spam laws have similar overbreadth issues. CAUCE believes that it is possible to create more effective anti-spam laws than the weak CAN SPAM without running afoul of First Amendment issues and will continue to work to help pass them.

Earlier today Neil Schwartzman, the CAUCE Executive Director, did a series of interviews for the Canadian Broadcasting Corporation radio 'drive' shows. He focused on why Canada doesn't (yet) have anti-spam legislation, who is behind the spam we all receive, why and how laws will help, and how internet users can protect themselves. Here's a recording of one of the interviews, conducted by All Points West host Jo-Ann Roberts for the Victoria, British Columbia CBC Radio One station, reproduced with permission.

In an article published by the Technology Liberation Front, Cato Institute adjunct scholar Tim Lee dissects a recent argument by the American Civil Liberties Union regarding free speech & anti-spam laws.

It's been interesting to watch the ACLU wrestle with anti-spam legislation. Their entire purpose is to work through the legal system to protect our civil rights, as defined in the First Amendment -- which is why I've been a card-carrying member since before I was old enough to vote -- so of course they're going to push back against any perceived abridgment of the right to free speech, including anonymous speech. Yet as Tim Lee argues, the amount of speech afforded to spammers before they run afoul of the Virginia statue is enormous: "someone may (a) send out an unlimited number of emails using a real email address, (b) send out 9999 emails per day (99,999 per month, 999,999 per year) while falsifying email headers, or (c) send out an unlimited number of emails with falsified addresses to people who have previously consented to receive them."

In order to violate this Virginia statute, you have to be very bad. In order to violate CAN-SPAM & get even more federal attention, you have to be even worse. Anyone with a real need for free, anonymous speech will have a myriad of other, simpler, and very likely cheaper avenues available to them -- including, unfortunately, sending 9999 forged, unsolicited emails each & every day.