FTC Goes After Spammers

klaun writes: "Yahoo has an article about the FTC launching a crackdown on deceptive unsolicited email. Basically they are after scammers offering easy money quick, not the average 'get porn here' type of spam. There is more info at the in a press release at the FTC's website." TheGreatGraySkwid amplifies, saying that this story "tells of an FTC crackdown on Spammers, that had resulted in charges (settled) against 7 chain-letter ring spammers, and several pending cases. I know I could use some Spam relief..." The settlement, unfortunately, isn't exactly stern stuff: the seven spammers "agreed to refrain from participating in deceptive schemes in the future, or lying about the legality or potential earnings from any such schemes."

Comments

For the lazy

[NewbieSpaz]

FTC Launches 'Spam' E-Mail Crackdown
By Andy Sullivan

WASHINGTON (Reuters) - Federal regulators kicked off a crackdown on the junk e-mail known as ``spam'' on Tuesday with an announcement that they had settled charges against seven people accused of running an e-mail pyramid scheme.

The Federal Trade Commission said that the seven defendants had participated in a chain-letter scam that promised returns of up to $46,000 for a $5 payment. Such chain letters are illegal in the U.S.

The chain letter eventually drew in more than 2,000 participants from nearly 60 countries, the FTC said.

While the consumer-protection agency has targeted some 200 Internet-based scams over the past several years, it has not until now gone after spam.

FTC Chairman Timothy Muris said the agency now had e-mail scams in its sights.

``We're going after deceptive spam and the people who send it. We want it off the Net,'' Muris said at a press conference.

The agency plans to settle several more cases within six months, said Eileen Harrington, the FTC's assistant director of marketing practices.

Spam has long been a hot-button issue for Internet users, who often find their inboxes clogged with unsolicited offers for pornography, fake diplomas, and get-rich-quick schemes.

Internet users received an average of 571 pieces of unsolicited commercial e-mail in 2001, a number expected to rise to nearly 1,500 by 2006, according to Jupiter Media Metrix.

Nineteen states have passed anti-spam laws, but attempts to pass a national law have stumbled over opposition from direct marketers who say their activities would be unfairly limited.

FTC officials said they will go after spam using existing laws that prohibit false or deceptive trade practices.

In addition to chain letters, pyramid schemes and other scams, the agency will target spammers who use deceptive return addresses or do not respond to consumer requests to be taken off their contact lists, said Howard Beales, head of the FTC's Bureau of Consumer Protection.

Spammers are not likely to face jail time or large fines from FTC actions. In deceptive-trade cases, the agency can usually only force companies to give back profits and pursue ''structural'' remedies that modify future behavior.

The seven spammers, who had been sent letters of warning by the FTC in September 2000, agreed to refrain from participating in deceptive schemes in the future, or lying about the legality or potential earnings from any such schemes. In addition, the defendants must return any money they take in from the chain letter in the future, can not share their lists of recruits, and must submit to FTC oversight of their actions.

Some 2,000 other participants in the chain letter received a warning letter from the consumer-protection agency.

While the FTC is preparing a national ``do not call'' list for telemarketers, a ``do not spam'' list would probably not be effective, Harrington said.

Harrington said Web users should forward spam to the FTC for analysis, using the e-mail address uce+ftc.gov. The agency has amassed a database of 8.5 million spam messages, and takes in an additional 10,000 per day, she said.

We need technical measures, not laws, for spam

[geek00]

I think these senators don't comprehend the reality with spam; that is, 99% of it has false origin information and has an opt-out scheme that doesn't work or only results in more spam.

However, I don't believe in making laws against spam. They'll always be outdated and interfere with legimate uses of email, since it can be very hard to define exactly what is spam. (Someone taking my address from a newsgroup posting and trying to sell me printer toner is spamming, but how about an email from a company I bought something from a year ago?)

Adam Back has an interesting proposal called Hash Cash. The idea is that if you want to send me an email, you have to burn some CPU cycles to compute a partial hash collision. I choose how many bits are required. Friends and family can send me email for free. I'll charge a few bits for the store I shooped at last week, and even more for people I don't know. If you're in ORBS or MAPS, perhaps I'll charge even more.

Re:We need technical measures, not laws, for spam

[EisPick]

I think these senators don't comprehend the reality with spam

I think there's a glass houses problem here. Someone who makes no effort to understand how government works has no room to say others "don't comprehend the reality ...."
Neither senators nor new laws are mentioned in this article. This article is about the FTC -- an agency within the executive branch -- applying existing law to spammers.

The FTC is applying the same laws that prohibit mail fraud and phone fraud to email fraud. They're not prosecuting spammers, they're prosecuting people who engage in false or deceptive trade practices, regarless of the medium of communication they use.

Re:We need technical measures, not laws, for spam

[poot_rootbeer]

I don't think laws against spam will succeed in having a preventative effect on the behavior, but perhaps they could have a punitive effect. Most laws are already like this--just because the laws say that you're not supposed to kill people, drive over the speed limit, doesn't mean you won't be able to do those things. But if you do, and you get caught, you're going to have hell to pay.

Cypherspace.org seems to be /.ed so I can't read the Hash Cash proposal itself, so I'm going based on your summary of it.

The problems I see with such a system:
1. Requires two-way communication between sender and recipient to establish a one-directional message transfer. Potentially could waste more bandwidth than blindly sending out spam does today.
2. Requires end-users to set up "scorefiles" to dictate how much they trust every sender in the world. At best, provides users with no more functionality than existing score-based mail filters/readers.
3. Ties senders' ability to get their message out to the CPU power of their machine. Owners of dual-10GHz Pentathlon systems should not have a louder voice than the hobbyist running sendmail on an old 286.
4. Spammers HAVE CPU cycles to burn--like most of us, their machines rarely run anywhere near 100% load. They will learn to send out their garbage in a slow,steady stream rather than in huge batches so that their machines can handle it--simultaneously making bulk-mailing harder to identify.

Re:We need technical measures, not laws, for spam

[Geekboy(Wizard)]

But ebay and amazon AREN'T spam. Those are opt-in lists. They also honor opt-out lists. If ebay and amazon sold their contact list, ignoring any opt-out lists, THEN they are contributing to spam, if not nessacaraly sending it themselves. I have some bunk email addresses that I have for public use, and some specific email addresses for mailing lists, and 2 or 3 for private use. I can determine where the spam is comming from based on that, and assist the mailing lists with tracking down the culprit. OR I can just set up a new email address, and change my subscribe address. I have had 2 or more email address for quite a while, at least one for public (email lists, slashdot, contact for e-stores) and one private (personal friends, etc).

Re:We need technical measures, not laws, for spam

[walt-sjc]

People: Stoping spam by changing email standards WON'T WORK.

First, it will take YEARS to implement any new standard. If you don't believe me, look at IPv6!

Second, any scheme based on charging per email no matter WHAT the details of this scheme is NOT THE ANSWER. It totally hoses things like mailing lists, SMS, autoresponders, email based applications (send an email command, cause something to happen), kiosk email, etc., etc., etc.

Third, (stupid HashCash), how the hell do you hand out a business cards with your email on it and expect people to be able to communicate with you without jumping through hoops.

Bottom line is that SPAM is NOT a TECHNICAL PROBLEM. It's a SOCIAL PROBLEM, like murder, rape, theft, hate crimes, drugs, etc. The reason women don't get raped every time they walk out the door is because we have set moral and legal standards in our society. We need to set those same standards for spam.

No matter WHAT technical barriers you set up, you either make the system virtually unusable (whitelists, auto-responding password challenges,) impractical (hashcash, charging real money, etc.,) or impotent (spammers will find a way around filters...)

Just like we have laws against theft, rape, and murder, we need laws against spam. Sure, we still have some cases of rape, murder, and theft, but I would MUCH rather have a couple spams per year (that I may be able to recover $$$ damages on) than to have a police-state driven, hostile, and unusable email system. These "technological whiz-kid" solutions will screw us all rather than just screwing the spammers.

Think about it.

The FTC sucks at dealing with fax spam

[crumbz]

I had a fax spammer hit our Chicago office about a dozen times last fall. They were a discount travel brokerage out of Baltimore, MD. Despite repeated attempts to get them to stop, we had to resort to a cease and desist letter from our attorneys to stop them. Previous calls to them generated abusive language and hang-ups. Sent emails to the contacts at the FTC with no response. None.

Maybe they will actually fund and staff the elctronic incident center, but I doubt it. If they won't deal with spammers in the U.S. what is the chance that they will contact overseas abusers?

My two cents.

Let's get 'em all...

[ekrout]

Basically they are [going] after scammers offering easy money quick, not the average 'get porn here' type of spam.

I personally feel that the porm spam can be just as deceptive as the EZ $$$ NOW! scams.

I mean, let's be honest -- I'm sure we've all received dozens and dozens of emails saying that someone's site has a ton of free pics and videos of the hottest girls. But generally that's a blatant lie, and the lewd site is a reseller of explicit pornography. They simply tell a fib to get you to click on over to their site, which upon being rendered throws a half-dozen pop-up windows on the desktop.

Let's aim higher rather than just taking out the con artists alone.

Listen To My Latest Recording @ EricKrout.com

Re:Let's get 'em all...

[jesser]

They simply tell a fib to get you to click on over to their site, which upon being rendered throws a half-dozen pop-up windows on the desktop. Let's aim higher rather than just taking out the con artists alone.

The FTC has gone after "trap" sites -- sites with extremely high numbers of pop-ups, or "hydra" ads. In that case, the domain names were misspellings of other popular domains, but I don't think it's a huge leap from misspelled domain names to misleading spam with forged headers.

I'd also like to see the FTC sue advertisers on both porn and non-porn sites that make their banner ads look like browser dialogs windows.

I'll believe it...

[Heem]

I'll believe it when my junk email is reduced by even 1% over the course of a month. Even without engaging in 'spam-risky' internet behaviour, ie - using real email address on newsgroups, web boards, signing up for free porn etc, I get a very large load of spam daily. One program that has been great is Mailwasher. This little utility allows you to bounce, blacklist and delete your spam before you download the actual message from your server. I then monthly take the blacklist it generates and add the email address or sometimes a whole domain to my email servers reject file... But still spammers get craftier and craftier. If only I could make a filter that would filter out anything like 12k3jhk213 and asdfl231.. hmm..

Re:I'll believe it...

[smnolde]

Don't forget spamassassin. I installed this yesterday and it has caught every bit of spam entering my mail server from all sorts of mailing lists.

Configuration is simple and straight forward and it integrates nicely with any email system. Personally I'm using exim to pipe all received email through spamc/spamd and then the mail is received by exim after the spam check. There is only one check for spam per email entering my system.

Spamassassin only flags the email as spam, but it's up to the MUA to actually delete it.

This is log output from exim+SA: 2002-02-12 17:21:35 From: Subject: *****SPAM***** save money for dank X-Spam-Status: Yes, hits=14.1 required=5.0 tests=NO_REAL_NAME, FROM_ENDS_IN_NUMS, INVALID_DATE_NO_TZ, REPLY_REMOVE_SUBJECT, EXCUSE_3,REMOVE_SUBJ, TO_BE_REMOVED_REPLY, SUPERLONG_LINE, FREQ_SPAM_PHRASE, FORGED_YAHOO_RCVD version=2.01 Sender: owner-freebsd-questions@freebsd.org

I'll soon move all my email users' to email filtered by spamassassin. This is just too damn simple.

Freedom!

[SirSlud]

> agreed to refrain from participating in deceptive schemes in the future, or lying about the legality or potential earnings from any such schemes

... in fact, they were encouraged to visit an FTC hyperlink where they could enter their email addresses opt-out of receiving any warnings or punishments in the future. ;)

Just got this spam today....

[tsmit]

Just got a spam message today that was in the format of a returned mail message. Even from Mail Delivery Subsystem. The attachment was an ad for pr0n.

I hate spam as much as the next guy, but, damnit, that's almost ingenious.

Re:Just got this spam today....

[kindbud]

Yes, you can use the Microsoft.com mail servers for this purpose. In fact, you can use any Exchange server for this purpose. They all accept mail before determining whether it can be delivered, have no capability to block recipients, and generate a new messages for the bounce, with the original attached. Perfect for all your spamming needs:


mail from:<targets@address.com>
200 ok
rcpt to:<nosuchmailbox@microsoft.com>
200 ok
data
Subject: pr0n served fresh daily

.
250 ok

Re:Just got this spam today....

[EvilGwyn]

They all accept mail before determining whether it can be delivered

You forgot to add the "by default". It is possible to set up an exchange system so that it will not relay and will send a 550 back after looking at the RCPT TO: line.

Slap on the Wrist

[Renraku]

This is just a slap on the wrist for spammers. What they need to do is impose a per-email fine per recorded spam from a particular company, and if the violations keep stacking up, blacklist them from ISPs or start posting names/addresses of the spammers involved. All of those would be good. Ruin their reputation even more, take away most of their earnings, and make it damn hard for them to get decent internet access again. And if they do get internet access, it should be monitored for large amounts of outgoing mail. Maybe a per-day quota could be set up for the spammer.

Re:Slap on the Wrist

[Misch]

Actually, we do have something very similar (sans fines), it's called Spamhaus. It collects evidence of spamming by companies, finds those companies that own those netblocks, and lists the top spam-friendly hosts in the ISP business.

Sitting at the top of the list is media3, which hosts 5 known spammers has known about them for at least 2,163 operational days (operational days for all 5 spam sources), and acts covertly to support them. Their "score" is thus listed as 5*2163*4 = 42,720, nearly 8 times more than the closest spammers. If you want your spam to decrease significantly, you gotta take out those spammers at the top right at their source.

-Misch

Re:Slap on the Wrist

[kindbud]

Most of those operational days were accumulated while media3 was listed at Spamhaus. Fat lot of good the Spamhaus listing did. Are you trying to actually do something, or are you just keeping score?

Re:Slap on the Wrist

[Matt - Duke '05]

This is just a slap on the wrist for Napster/Morpheus/[Insert P2P program here] users. What they need to do is impose a per download fine per copyright infrigement from a particular P2P user, and if the violations keep stacking up, blacklist them from ISPs or start posting names/addresses of the downloaders involved. All of those would be good. Ruin their reputation even more, take away most of the music/pictures/movies that isn't theirs, and make it damn hard for them to get decent internet access again. And if they do get internet access, it should be monitored for large amounts of incoming and outgoing traffic on the ports used by P2P programs. Maybe a per-day quota could be set up for the file sharer.

You can't have your cake and eat it too. Either the Internet is regulated or it is not. You can't ask the FTC to penalize and enforce the law on spammers when in the next breathe, you ask the government NOT to penalize and enforce the law on intellectual property/copyright.

You feel this way because someone is breaking a law designed to protect you, so you feel violated. Now, the innocent little P2P users may not be hurting you, but they are certainly infringing on laws designed to protect someone else.

Your logic is a great example of the selfish me-me-me whining prevalent in a majority of slashdot posters. Pirated software, MP3s, movies, etc are good because they benefit me!! Don't enforce the laws against this!! Spam is bad because although someone else is getting a free-ride, I am not. Enforce the laws against this!!

Now, I'm not saying by any means that P2P users are evil or should be prosecuted. I just think that before people run around asking for any statutory regulation of the net, they need to think about the flipside of the situation as well. Do you want the net regulated or don't you? You can't have the both and allowing any sort of regulation and enforcement (i.e. spam) only leads the government to further believe that the net should be regulated and all laws fully enforced.

Just my two pennies...

Did someone in Congress finally get SPAM?

[eaddict]

I wonder which Congress person got burned on the pyrmaid thing THEN screamed it was SPAM.

A lot of the spam originates in China, so...

[Ryu2]

The Chinese government just ordered all ISPs in China to start monitoring
email for subversive phrases and the like, so just reply to
Chinese spam with little replies of the form at the end of this spam.
Might be a useful tactic on companies who think that unsolicited
email is "just regular advertising".

Bill

"Jack(export manager)" wrote:
>
> Dear Sir
> How are you .
>
> We are a lighting factory in China ,It is glad
> to introduce ourselves to you:
>
> I am XUBIN (Jack) , XUBIN is my chinese name , you can just
> call me Jack !! , I am export manager of [deleted] ,
> China, our group have four factory
[snipped]
>
> Here is our company profile :
>

[Rest of sales talk snipped]

(And now, the reply)

Thank you for your coded order. The weapons and ammunition
will ship by way of the usual route in ten days, and you
already know our secret Swiss bank account number to
wire the payment to.

It is a pleasure doing business with you for so long,
and I hope your cause will prevail. I am new to this
particular computer, so I hope the encryption is
working and the monitoring authorities cannot read
what I am sending you.

Long live the Falun Gong! Free Tibet!

Best regards,
Your arms supplier

Speak for yourself

[mrroot]

From the FTC press release:

Chances are you will receive little or no money back on your "investment." Despite the claims, a chain letter will never make you rich.
Speak for yourself. I made over $46,000 dollars in 90 days, and you can too! and it's totally legal. To learn how, just mail me $5.00.

my understanding from the FTC press release

[Twister002]

You can read it here.

My understanding is that they are going after the chain mail and pyramid schemes, not trying to shut down all the porn email (oooooh, hot girls waiting just for ME!!! WOW!!!) So it won't do anything about the deluge of unwanted email pouring into your inbox, just keep people that are dumb enough to answer the ads from hurting themselves. Like putting nerf corners on the world of email for them

I would rather see some kind of legislation that holds spammers accountable if their "remove' methods do not work. I think a "do not call" type of list would be better than nothing. Filters don't always work, no matter how well you configure them. Maybe a new version of the SMTP protocol that would require a secure connection or authentication by you to be able to send you an email

--insert comment to the effect of "what has slashdot come to posting this type of story
--insert comment to the effect of "if you weren't such a loser you wouldn't get spam"
--insert comment to the effect of "jane you ignorant slut that's not what it says at all"
--insert comment to the effect of "this is all the fault of M$ and their monopolistic practices"

Here you go:

[mrroot]

Defendants in the FTC cases are: Paul K. Boivin, also known as Paul Bowen, Paul Boevien, Paul Bowvien, and Paul Brown; doing business as (DBA) Destiny 1999, Destiny 2000, and Destiny 2001. The defendant is based in Clearwater, Florida and the case was filed in the U.S. District Court for the Middle District of Florida, Tampa Division. Chad Estenson and Megan Estenson, DBA CMJ Enterprises and Rockin' E Marketing. The defendants are based in Warwick, North Dakota, and the case was filed in U.S. District Court for the District of North Dakota. Fernando Pacheco, also known as Frank Pacheco, DBA E-Solutions and E-Solutions 101. The defendant is based in North Providence, Rhode Island and the case was filed in U.S. District Court for the District of Rhode Island. Arnold W. Larsen, also known as Arnold Larson. The defendant is based in Sarasota, Florida, and the case was filed in U.S. District Court for the Middle District of Florida, Tampa Division. John Lutheran. The defendant is based in San Diego, California. The case was filed in U.S. District Court for the Southern District of California. Dario Va. The defendant is based in Weston, Florida. The case was filed in U.S. District Court for the Southern District of Florida.

amazing

[negativethirsty]

Ok follow along, I'll go slowing for the gov't FTC workers... FTC: "you spammes are thieves and liers! Quit pulling these scams." spammer: "You are right, we are liers." FTC: "So does this mean you'll stop?" spammer: "Sure"

Me too, but . . . Re:Just got this spam today....

[StefanJ]

I assumed that me email address had been used BY the spammer as a fake "From:" address.

That worried me more than actual spam. I'd hate to get falsely accused of sending out "HOT SCHOOLGIRL, GOAT, AND LHAPSO-APSO ACTION!" messages.

Deceptive Advertising...

[Chris Parrinello]

I think the FTC needs to crack down on these so called "Nude Teen Cheerleader" websites. If they're nude, how do you know they're really cheerleaders?

I am demanding that the FTC require (under penalty of large fines) that all nude teen cheerleaders be photographed with their high school ID showing their date of birth and their high school yearbook turned to the page where their cheerleading squad group picture is.

I think if the web site says "cheerleader" and then the model was actually in the pom-pom or flag squad, the fines should be TREBLE.

FTC Sends Out "Fake Spams"

[euphline]

Washington, DC-- In a move likely prompted by the SEC's recent creation of fake investment scam sites, the FTC began a campaign today to send out masses of electronic mail (known as "spam") to millions of unsuspecting internet users. Apparently, the messages, with subjects such as "Get Rich Quick", "Work From Home", and "Hi, Joe" have quickly filled user's mailboxes. When a user clicks on the link, they are taken to a web site that, upon further inspection, attempts to educate the user about the fake get rich schemes.

When a user clicks on the "unsubscribe" option, their email address is logged by the FTC. The FTC sends an autoreply indicating that using the "unsubscribe" option on spams is dangerous.

-jbn

indecision and inaction

[gioan]

Wonderful. People committing clear financial fraud have to "play nice in the future." Oh great. I feel so much better. It's clear that uce@ftc.gov has less productive output than /dev/null.

This isn't about free speech, or "corporate right to send me ads if I opt-in." Don't worry, those companies make sure they pay someone to remind your senators that their god-given-right to send you ads should be permitted. Too bad the rest of the spam won't really let you work part time from home making $10,000/month while watching a legal cable descrambler, happy with a clear credit record, a really large penis, limitless virility, instant weight loss on demand, and the occasional degree from a prestigious unaccredited school.

There are two reasons spam continues. Welcome to economics:

a) there's still no effective financial deterrent to sending spam, regardless of whether it's ambiguously relevant direct marketing, or utter fraud
b) there is some financial benefit for the senders, regardless of amount

There are plenty of other things you could debate...such as when did spam become accepted? Was it when you -- yes YOU! -- made the unconscious decision that "just deleting" the message is OK. You don't have the time to follow up on the headers. If you're in one of the states that actually ban it, you don't have the time to do something...hell it's not worth the effort. It's just an email, right?
Think of this in another way: If random people each stole one cent out of your bank account every month, would you consider it worthwhile to pursue them? Would you want your bank to develop filters to block all small transactions? Would you think such a loss is unacceptable?

Quite honestly, the actions of civil libertarians and "we'll fix this with technology" advocates has not helped. I filter, you filter, we all delete. Guess what, spammers will continue to find ways around filters, so long as conditions A & B hold true. And every online provider will continue to spend lots of money trying to stop this crap. And every user will continue to hit delete. And people will constantly change email addresses to avoid it, spam filters will continue to mislabel valid email as spam. Stop dealing with the symptoms, deal with the problem!

This isn't a technology issue. You will never get every mail server, client, system, whatever to comply to a block-spam standard. Just look at how long it's taken to get even the basic don't-relay habits in place. This isn't a "but what if I want Amazon to send me my favorite buy-me-now specials." This is an issue that someone in power doesn't give enough of a damn to do something effective to create a financial deterrent that makes it preferrable for these people to steal your money some other way. And yes, unfortunately, we're talking legislation, otherwise you will not send a clear message or provide an effective deterrent. Inconsistency on this means ineffective.

Wow, looking back I'm feeling sorry for the rant. It's simply that this kind of cluelessness annoys me. Time to go delete a couple more messages.