US war on spam may put NZ at risk

By ADAM GIFFORD

Four leading United States internet providers are taking some of the world's leading spammers to court under the new Can-spam Act.

If that sounds good, bear this in mind - spammers such as Davis Wolfgang Hawke and Eric Head, who have made millions sending bulk unsolicited emails, could shift base to New Zealand where there is no anti-spam law.

Internet NZ board member David Harris, the creator of Pegasus Mail, this month attended a regional anti-spam group meeting in Malaysia.

"It was depressing to see how far behind we were on the legislative front. Countries like Taiwan and China were further ahead," Harris said. "The New Zealand Government is saying all the right things, but it is not doing anything."

Associate Information Technology Minister David Cunliffe bristled at that suggestion, and said policy work had been under way since late last year.

"My officials have looked at a range of legislative vehicles, from amendments to the Harassment Act to the option of a standalone bill," Cunliffe said. "My view is a standalone bill is more likely, using an opt-in approach like Australia."

An Australian anti-spam law, which came into effect this year, says people should not receive unsolicited commercial emails unless they have indicated they want such communications.

The US Can-spam law has been widely criticised because it takes an opt-out approach - that people have to tell spammers they don't want to get any more mail from them.

The advice Internet NZ gives on its new stopspam.net.nz site, put together by Harris, is never reply to spam, because that tells spammers the address is valid, and never use the remove option, because that shows you have read the spam thoroughly and therefore will be sent a deluge of spam.

Cunliffe said he was working on a discussion paper for Cabinet.

"I can say I aim to have a bill introduced this year and passed as soon as possible, but that must be weighed against the Government's other legislative priorities," he said.

Harris said the Government should just adopt the Australian law, which was developed and passed in just four months.

He said a combination of education, technology, legislation and enforcement would put the spammers out of business.

"Some technologists say legislation never solved anything. I can't agree with that. Legislation is how society discriminates between things which are acceptable or not.

"We need that moral imperative."

The weakness in the current system can be seen with the response Internet NZ received when it tried to get authorities to take action against Shane Atkinson, the Christchurch man outed by the Herald last year for sending tens of millions of emails touting penis-enlargement pills.

"Internet NZ lodged formal complaints with the police, Internal Affairs, the Commerce Commission and the body which regulates drugs," Harris said.

"The police said straight up, 'this is not our area, we can't help you', but the rest just stood around pointing the finger at each other.

"Even though we think there are existing laws which we believe can be used against spammers, there is no will to enforce them, so there are whole classes of crime you can commit in New Zealand with no fear of there being any consequences."

The risk is that as other countries move against spam, New Zealand could be identified as spam-friendly, and find email addresses originating here are blocked.

The reason for the pressure is because spam is continuing to grow.

Spam filter vendor Brightmail says 62 per cent of all email in February was spam, an increase of 2 per cent on the previous month. At that rate of increase it would be more than 80 per cent by the end of the year.

There is also now clear evidence computer viruses and spam are linked.

The payload in some recent viruses has been "Phatbots" - programs which allow infected computers to be used to route spams or to act as proxy servers disguising the IP (internet protocol) address of the spammer's real server.

While there are things individuals can do - keep their email address off websites or chatrooms, not buy anything from spammers or reply to spam, set their email programs to not accept images, or run their own spam filter software - most rely on internet providers to filter most spams out.

That raises the risk of false positives - not receiving an important email because the software thought it was spam.

Clearnet and Xtra both use Brightmail to filter spam. Iconz uses the New Zealand-made Death2Spam product. Other internet providers use Spamassassin, blocklists or tag potential spams before sending them on.

Harris said that was only part of the answer.

"You can filter the bulk of spam but it is still consuming bandwidth, it is consuming processing power and disk space as it passes across the internet and it is consuming vast quantities of developer time."

He said the only thing that would stop spammers, short of taking them out and shooting them, was to take away the money they made.

The former option should strike a chord with arch-spammer Davis Wolfgang Hawke, who in 1999 told Fox News, "I plan to make the Final Solution a reality."

According to information contained on the spamhaus.org Rokso list (register of known spam organisations), that was the year the then 20-year-old college student's plan to become the American Hitler came unstuck, when it emerged he was born Andrew Greenbaum.

The "kosher nazi" turned his computer talents to selling penis pills, with great success. Many internet users will be watching with interest his day in court.


Can that spam Spam made up 62 per cent of internet email in February, of which product advertising made up 24 per cent, 14 per cent was porn, 11 per cent scams and 4 per cent straight-out fraud.

The US Federal Trade Commission estimates identity theft, where spammers have stolen or tricked people into giving them financial details or passwords, has cost US consumers US$60 billion ($91.8 billion) over the past five years.

Never give out your credit card information or a bank pin number in response to an email. Banks never send out such emails.

Many internet providers attempt to block spam before it gets to your inbox. There is a list of some at stopspam.co.nz.