🚀 go-pugleaf

In article <3519CCCC.93222E2E@hotmail.com>, Buzz  <purphaze@hotmail.com> wrote:
>> In article <35189EF8.289B9C85@hotmail.com>, Buzz  <purphaze@hotmail.com> wrote:
>> >Hard drives do not cost very much anymore. You can buy a tower of
>> >9-18Gb drives for a few grand, to an ISP with a few hundred or a few
>> >thousand users, this is not a lot of money to spend. How much space, in
>> >your opinion, would be absorbed by spam on an average ISP's server?
>> >Just wondering.

>> That's rather like saying that after a thief breaks into your house,
>> bypassing the reasonable controls you've put in place to prevent it,
>> that instead of jailing the thief for theft, you should buy more stuff
>> to keep him happy and coming back for more.  Do you have any concept
>> of what "property rights" mean?  Or trespass?

>The words trespass and private do not always apply on the internet.
>Am I wrong on this?

Quite.  Most Internet links are private property, and virtually all of
the systems connected to it are as well.  As such, the owners get to
decide what these links are being used for.  In the past, people didn't
get very upset about (minor) misuses, because, carrying each other's
traffic is part of the quid-pro-quo of existing on the Internet.

However, nowadays, people are faced with the fact that the infrastructure
that they've spent 10s of millions of dollars establishing for their
own purposes, is now sponsoring freeloaders, and in many cases outright
criminals who are swamping their resources.

>Are you expecting these things over the internet?

I'm expecting people to respect our wishes when they attempt to 
use our resources.  They refuse to respect them.  And in many cases
they attempt to wreck or overload our systems when we try to stop
them.

>Your house is made of glass when it's on line. It is a public domain.

Public domain would mean that private property is actually publically
owned (or owned by no-one), and that everyone has the right to use it.
Nothing could be farther from the truth.

Our company has one of the largest private Internets on the planet.
We didn't build it to subsidize spammers trying to ram 500,000
spams through them in a day.

>Your home is not a public domain, If you can't stop someone from
>physically stuffing things into your mailbox,

But I can.  I can post signs on my property explicitly forbidding
people dropping stuff in my mailbox.  I can also get the Post Office
to not deliver junk mail.

Doesn't work on the Internet.

>how do you expect to do that with your email?

I should be able to for exactly the same reason.

>Since you can sue a spammer as others have pointed out,
>then that is the action to be taken in those cases.

Do you have any conception of how difficult it is to even identify
_who_ to sue in most cases?  Or, how difficult it is to, say,
sue someone in another country?   Or how it's possible for
a private individual to sue each and every one of the 100s
of different people spamming their mailboxes?

No, except in rare cases, civil action simply isn't practical.
But the harm is sufficiently high that legislation _should_
be introduced that makes it easier to take action.  The situation
is now that private individuals simply cannot afford to do anything.
Only extremely large corporations have a hope of being able to
afford legal action.

And, even if you win, the spammer never has any money to pay off
the judgement anyways.  So, you've spent several thousand
dollars and have nothing to show for it.

In the US, they've made a law (Telecommunications Privacy Act (TCPA) of
1994) that forbids the sending of unsolicited advertisements by FAX.
It makes it a civil crime, for which you can sue the FAX spammer.  For
rather large amounts.  The same arguments for "cost shifting" apply
with FAXes and email.  They're trying to extend this law (the "Smith
Bill") to cover e-mail.  All this law does is make it easier to take
civil action by making "unsolicited commercial email" actionable,
without having to quibble about volumes, crashes, outages, loss of
productivity etc.

>When you ask if I have any concept of what property rights
>are, Remember, I didn't invent spam, so why are you asking me
>as if I set the rules?

You have a number of rather erroneous assumptions about the
Internet, and spamming in general.  Leading you to some rather
ridiculous statements.  The Internet isn't public domain.
Our equipment is private property, intended _only_ for our
own purposes.

>I only asked for an approximate number of Mb's absorbed by spam.

I've already given plenty of stats.

Here's another: with the 500 or so people at my company 
participating in my "forward your spam to my analysis engine",
since September of 1997, they've forwarded me approximately 120,000
spams.  That's an average of 250 apiece.  Some users are up in the
thousands.  As for space, that works out to about 5Gb.

500 people is less than 1/2 of one percent of the company's total
population.  Work out the math.

Next, how much is it costing us aside from computer resources?
We're using a one minute of lost productivity per spam average.
That seems high, but when you realize how offended some of our
people get about some of the junk they get, the amount of time
taken up by Corporate Security tracking/explaining certain types
of extremely obnoxious (or threatening) spam, and by the vast
amounts of time chewed up by trying to cope with massive spamming
that takes whole systems down, it's probably conservative.

Work out the math: at $100/hour loaded labour rate, 120,000 spams
works out to about 2000 hours, or, $200,000.  Then remember that
it's less than 1% of our company reporting.  Some of our estimates
for the total of lost time due to email spam up in the $4-5 million
range per year.  Mine is around $50,000-$100,000 per _week_.

>> We _don't_ want the spam coming in.  We tell the spammers exactly
>> that (in the few cases where we can figure out where they are), and
>> instead of complying, they come up with new and inventive ways of
>> getting around our filters, stealing our resource to spam others,
>> etc.  They are trespassing at the very least.

>Then sue them

Sue _who_?  Have you ever tried tracking some of this crap?  Where
in order to sue, you have to:
	a) get a court order within a few days of the occurance served
	   on the ISP to find out who their logs say sent it to you.
	b) you find out that the ISP doesn't keep logs at all, or,
	   is completely incompetent, and can't tell themselves.
	c) then you find out that the account info was bogus to begin
	   with, paid by money order...
	d) then serve the credit card company, and it turns out to be
	   a bogus card ....

Etc.  We can identify at most 10% of spammers with enough certainty
to sue.

Several have done the legwork.  Sanford Wallace (Cyberpromo) has
lost over $2 million dollars worth of lawsuits by continued spamming.
And you know what?  It didn't stop him - Sanford is simply and
completely nuts.

>> Ask AOL sometime how much it costs to provide email services to their
>> customers.  The answer is up in the 10s of millions.  Then, take 30%
>> of that.  Big number, right?

>Yes, that is a large number, much more than I imagined.
>It's an outrage to know that it has reached that level without
>any firm body or committee to be assigned to stop it.

Join CAUCE at www.cauce.org and support the Smith Bill.  There
is a lot going on.  There are many other organizations.

>Chris, if the spam has been constantly coming in for a
>while now, and in huge numbers, doesn't that indicate
>that someone (or many someone's) are responding positively
>to it? Like someone has to be buying what their selling, or
>wouldn't even the most hardened advertise give up at that point?

Years of experience at this game has shown that the old saw
"There's a sucker born every minute" applies in spades to the
Internet.  The spammers-for-hire talk a good line about the
millions to be made, but it's entirely vapour.

I've spoken to hundreds of spammers under varying conditions,
and the answer is always the same - they do not make any money
at all.  One guy advertising raffle tickets for an internationally
respected charity admitted to having only been able to sell one
ticket, and got ripped off for a couple more.

One particular satisfying one was the story about Jef Slaton.
The original self-styled Spam King, who delighted in not only
spamming everyone over and over, he forged his spams in other
people's names (including mine) to take revenge, and continued
to brag and strut about how much money he was making.

As it turns out, at the very time he was claiming that he
was making $50,000/month, he was actually filing for personal
bankruptcy, lost both cars, his house, his business, and may
still end up in jail for defrauding a church.

Sanford Wallace, who is thought to have been personally responsible
for the implementation of the TCPA (outlawing FAX spam), and
blasting out 6 million spams per day to AOL alone, is now reduced
to distributing flyers for restaurants in Pittsburgh.

Kevin Jay Lipsitz, the infamous "500 magazine" spammer, was
convicted of fraud.

Depending on where you look, between 80% and 95% of all spam
is either sex ads, or "get rich quick using Internet marketting"
ads.  No other advertisements repeat beyond a few iterations.

Sex sells, as it always does.  _Nothing_ else does, aside from the
false dreams sold by the spammers-for-hire.

>They risk being prohibited by ISP's, they risk being sued and
>risk the wrath of many knowledgeable computer users. Why do
>they continue to do this if no one is buying?

They've been suckered.

>And secondly, if people are reading and buying, then this
>would be considered a service not a dis-service. So
>does that mean you would be cutting off a "service" for some.

Our company line is: "Our systems are intended for our business
purposes only.  We own them.  If we decide that spam to our
users is consuming too much people and technical resources, and
shut spam off, that is our right.  If any employee really wants
to get this stuff, they can buy their own ISP account.".

Secondly, many surveys have been done.  Once you discount the bogus
ones generated by spammers themselves, you see that the number of
people who actually _want_ the stuff (those being the ones who don't
get much), is around 5%.  If only 5% want it, then what they can
do is opt-in to advertisers, or cruise web sites.

And finally, spam filtering is a thing that ISPs can use
to differentiate themselves from other ISPs.

Say, an ISP implements good spam filtering.  For every customer
who objects (and can simply move to some other ISP without
filtering), the ISP will gain 10 customers who want the
filtering.

The problem is becoming quite serious of late.  I've had literally
hundreds of people ask me what to do about all of the porn spam
being rammed down their throats, about how many people are afraid
to participate on the Internet for fear of being bombarded with junk,
and how difficult it is for children to participate at all, anywhere
on the net.

We have spammers sending pornographic pictures into schoolnet
and k12.  We have  spammers sending rape pictures into
alt.sexual.abuse.recovery.  We have spammers sending mail and
Usenet messages containing javascript programs that attach
you without warning to porn web sites just by clicking on the
message.

It has to stop.

>BTW  thank you for not resorting to repeated personal
>attacks, one or two is no problem.

It would help if you were a little careful about the assertions
you make based on inadequate information.
-- 
Rumours of my demise are greatly exaggerated.
Cold but happy, please pass the thermos!

For more information on spam, see http://spam.abuse.net/spam