Spam

Updates

The very first spam email was sent by Gary Thuerk to about 400 recipients on 3 May 1978 over the Internet’s predecessor, ARPANET (Advanced Research Projects Agency NETwork). In April 2018, the daily average volume of spam was nearly 375 billion, according to Tallos. The original spam is a canned meat product and email 'spam' was named after a sketch from the Monty Python’s Flying Circus comedy programme. The use of the term spam expanded into other electronic communications since then. It is used for unsolicited communication in instant messaging, calls, social media, etc.

Kaspersky Lab has published a 2017 spam and phishing report. According to the report, the share of spam in e-mail traffic is down to 56.63%, having decreased by 1.68%  since 2016. The US remains the biggest source of spam (13.21%) followed by China (11.25%). However, the anti-phishing systems have identified an increase of nearly 58% of phishing attempts. The report informs a significant increase of scam pages migrating to HTTPS making it harder for users to reveal fraud.

Necurs, one of the largest known spam bot, distributed spam emails promoting an ill repute cryptocurrency named Swisscoin, reported BleepingComputer. The well-known pump & dump strategy usually used for manipulating stocks of companies has been applied in cryptocurrency environment on large scale for the first time. The actual impact is hard to measure because the first spam emails were distributed on the same day the Swisscoin currency was released for trading after more than 50 days of suspension period. The pump & dump manipulations of cryptocurrencies are not new. For example Business Insider wrote about pump & dump cryptocurrency market manipulations in November 2017.

Spamhaus Malware Labs issued block List (SBL) listings for more than 9,500 botnet Command & Control servers on 1,122 different networks in 2017. Botnet controllers play a key role in operations conducted by cybercriminals who are using infected machines to send out spam, ransomware, launch DDoS attacks, commit banking fraud, click-fraud or to mine cryptocurrencies. The report expects that that securing and protecting IoT devices will be a core topic in 2018. In conclusion Spamhaus urges registries and registrars to take their responsibility by implementing appropriate mechanisms to prevent fraudulent domain registrations.

Researchers have discovered a botnet, called Onliner, that has collected 711 million email accounts used to send spam messages. An open and accessible web server storing databases of addresses, passwords and email servers for sending spam was hosted in the Netherlands, ZDNet reported. The credential emails and servers are used by spammers to avoid spam filters. Among other, this spam-bot is believed to have distributed over 100,000 unique infections of a banking malware Ursnif to inboxes around the world.

The global spam rate for July was the highest seen since March 2015, increasing to 54.9 percent, reports Symantec in its July Intelligence report. Similar proportion of spam also reports the Kaspersky lab in its Spam and phishing in Q2 2017 report, however not indicating a peak in spam traffic. Both companies use their own metrics and mostly report on spam identified by their systems. 

Spam or unsolicited mail is sent to a wide number of Internet users. Spam is mainly used for commercial promotion. Its other uses include social activism, political campaigning, and the distribution of pornographic materials.

Spam is one of the Internet governance issues that affect almost everyone who connects to the Internet. However, whereas 10 years ago spam was one of the key governance issues, it is today a less prominent issues thanks to highly sophisticated technological filters.

 

According to statistics from 2014, 66% of e-mail traffic is spam. Besides the fact that it is annoying, spam also causes considerable economic loss, both in terms of bandwidth used and lost time spent checking/deleting it.

Spam can be combated through both technical and legal means. On the technical side, many applications for filtering messages and detecting spam are available. Several best practices have been developed by the technical community, include those by the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), the Spamhaus Project, GSMA, and the Internet Society.

The issues of spam or unsolicited mail

There are various issues associated with spam. From a technical perspective, one of the main problems with filtering systems is that they are known to delete non-spam messages, too. For instance, Verizon’s anti-spam filtering led to a court case as it also blocked legitimate messages causing inconvenience for users who did not receive their legitimate e-mail. The anti-spam industry is large, and employs increasingly sophisticated applications capable of distinguishing spam from regular messages.

Another issue arises from the different definitions of spam. Different understandings affect the anti-spam campaign. In the USA, a general concern about the protection of the freedom of speech and the First Amendment affect the anti-spam campaign as well. US legislators consider spam to be only ‘unsolicited commercial e-mail’ leaving out other types of spam, including political activism and pornography. In most other countries, spam is considered to be any ‘unsolicited bulk e-mail’ regardless of its content. Since most spam is generated from the USA, this difference in definitions seriously limits any possibility of introducing an effective international anti-spam mechanism.

One of the structural enablers of spam is the possibility of sending e-mail messages with a fake sender’s address. There is a possible technical solution to this problem, which would require changes in existing Internet e-mail standards. The IETF has been considering changes to the e-mail protocol, which would ensure the authentication of e-mail. This is an example of how technical issues (standards) may affect policy. A possible trade-off that the introduction of e-mail authentication would bring is the restriction of anonymity on the Internet.

Most spam originates from outside a given country. It is a global problem requiring a global solution. There are various initiatives that could lead towards improved global cooperation. Some of them, such as bilateral MOUs, are mentioned below. Others measures include capacity building and information exchange. A more comprehensive solution would involve some sort of global anti-spam instrument. So far, developed countries prefer the strengthening of national legislations coupled with bilateral or regional anti-spam campaigns. Given their disadvantaged position of receiving a ‘global public bad’ originating mainly from developed countries, most developing countries are interested in shaping a global response to the spam problem.

The legal response to spam

Technical methods have only a limited effect and require complementary legal measures. On the legal side, many states have reacted by introducing new anti-spam laws. In the USA, the Can-Spam Law involves a delicate balance between allowing e-mail-based promotion and preventing spam. Although the law prescribes severe penalties for distributing spam, including prison terms of up to five years, some of its provisions, according to critics, tolerate or might even encourage spam activity. The starting, default, position set out in the law is that spam is allowed until the receiver of spam messages says ‘stop’ (by using an opt-out clause).

In July 2003, the EU introduced its own anti-spam law as part of its directive on privacy and electronic communications. The EU law encourages self regulation and private sector initiatives that would lead towards a reduction in spam. In November 2006, the European Commission adopted its Communication on Fighting Spam, Spyware and Malicious Software. The Communication identifies a number of actions to promote the implementation and enforcement of the existing legislation outlined above, as the lack of enforcement is seen as the main problem.

Both of the anti-spam laws adopted in the USA and the EU have one weakness: a lack of provision for preventing cross-border spam. The Canadian Industry Minister, Lucienne Robillard, stated that the problem cannot be solved on a ‘country by country’ basis.

A global solution is required, implemented through an international treaty or some similar mechanism. An MoU signed by Australia, Korea, and the UK is one of the first examples of international cooperation in the anti-spam campaign.

The OECD established a task force on spam and prepared an anti-spam toolkit. The ITU was also proactive by organising the Thematic Meeting on Countering Spam (2004) to consider various possibilities of establishing a global Memorandum of Understanding on Combating Spam. At regional level, the EU established the Network of Anti-Spam Enforcement Agencies, and APEC prepared a set of consumer guidelines.

Another initiative is the International Cybersecurity Enforcement Network implementing the London Action Plan. The network, established in 2004, gathers regulatory authorities, the technical community and the business sector to collaborate on cross-border spam enforcement.

More recently, measures against spam were introduced in the International Telecommunication Regulations which were amended in 2012. Among the new articles, two new provisions deal with the ‘security and robustness of networks’ (Article 6), and the prevention of ‘unsolicited bulk electronic communications’ (Article 7). However, the latter provision on spam does not contain binding language; rather, it merely states that states ‘should endeavour to take the necessary measures’ and encourages them to cooperate together. Similarly, Resolution 52 of the World Telecommunication Standardization Assembly ‘invites’ states to take appropriate steps to combat spam, and refers only to national frameworks.

Events

Instruments

Conventions

International Telecommunication Regulations (WCIT-12) (2012)

Resolutions & Declarations

ITU Resolution 52: Countering and combating spam (2012)
IPU Resolution on the Contribution of new information and communication technologies to good governance, the improvement of parliamentary democracy and the management of globalization (2003)

Standards

Recommendation ITU-T X.1240 - ‘Technologies involved in countering e-mail spam’ (2008)

Other Instruments

Resources

Publications

Internet Governance Acronym Glossary (2015)
An Introduction to Internet Governance (2014)

Papers

Fighting Spam by Breaking the Economy of Advertising by Unsolicited Emails (2015)
The Harvester, the Botmaster, and the Spammer: On the Relations Between the Different Actors in the Spam Landscape (2014)

Reports

Kaspersky Security Bulletin. Spam and Phishing in 2015 (2016)
Stocktaking, Analysis and Recommendations on the Protection of CIIs (2016)
The Global Risks Report 2016 (2016)
Best Practice Forum on the Regulation and Mitigation of Unsolicited Communications (2015)
Best Practices to Address Online, Mobile, and Telephony Threats (2015)
Global Cybersecurity Index & Cyberwellness Profiles (2015)
Best Practice Forum on Regulation and Mitigation of Unsolicited Communications (e.g. “spam”) (2014)
Quarterly Spam Reports

GIP event reports

Recent Cyber Incidents - Patterns, Vulnerabilities and Concerns (2017)

Other resources

The Twitter Rules (2016)
Combating Spam and Mobile Threats - Tutorials (2016)
Symantec 2015 Internet Security Threat Report (2015)
Combating Spam: Policy, Technical and Industry Approaches (2012)
The Top 10 Worst
Symantec Monthly Threat Report
M3AAWG Best Practices
Global Spam Map
Global Legal Summaries about Regulatory and Policy Updates Related to Digital Advertising

Processes

Click on the ( + ) sign to expand each day.

WSIS Forum 2016 Report

Spam related challenged faced by emerging economies were discussed in Spam: Understanding and Mitigating the Challenges Faced by Emerging Internet Economies (session 152). It was underlined during the session that spam has become a complex issue, as it is more and more associated with malicious content, and that emerging economies may not have enough technical, human, and financial resources to fight it. Possible modalities to break the vicious cycle of spam generation were discussed (such as spam filtering, intrusion detection, antiviruses and patches, and user education), and reference was made to key areas emerging economies need to work on to combat spam (legislation (with clear rules in place), staff (with technical and legal expertise), and tools).

 

The GIP Digital Watch observatory is provided by

in partnership with

and members of the GIP Steering Committee



 

GIP Digital Watch is operated by

Scroll to Top