US Military Looks For Massive Spam Solution

Several users have pointed out a recent request to technology companies from the Defense Information System Agency for ideas on how to build an e-mail defense system to catch spam. The solution would have to scan about 50 million inbound messages a day across some 700 unclassified network domains. "Defense currently scans e-mails for viruses and spam coming into systems serving the military services, commands or units. DISA wants to extend the protection to the interface between the Internet and its unclassified network, the Non-classified Internet Protocol Router Network. The agency also wants the ability to scan all outbound e-mails from the 5 million users. [...] DISA's request ties in with recommendations that the Defense Science Board issued in April that said Defense is more vulnerable to cyberattacks because of its decentralized networks and systems. The board envisioned a major role for DISA in developing the architecture for enterprise-wide systems."

Comments

Only one way to be sure

[Archangel Michael]

Nuke spammers from orbit.

Re:Only one way to be sure

[Shakrai]

Nuke spammers from orbit.

But then how will I be able to refinance my mortgage while getting that penis enlargement using the money I won in the British lottery?

I'm convinced that the only real solution to spam is to find the people who are stupid enough to buy the products offered via spam and beat the ever living shit out of them. The spammers wouldn't keep doing it if people didn't keep buying their shit.....

Re:Only one way to be sure

[linzeal]

Nuke people who respond to spam too. That way places with lots of old people like Florida would be glowing like the surface of the sun.

Re:Only one way to be sure

[Anonymous Coward]

It is easy to believe that companies keep sending spam because there is a sufficiently large group of customers who order there product after they receive the spam. But it's not true. In most cases the resulting sales do not outweigh the cost of sending spam. For this reason most companies will only try this a couple of times and then realize that it does not result in the promised increase of sales.
The real reason you keep receiving spam is that there is a almost endless stream of new companies that can be tricked into believing that sending spam would be a cost effective way of advertising there product.

Re:Only one way to be sure

[zorro-z]

I agree that the only way to end spam would be to make sure that nobody ever responded to it. There's one problem w/this, though: mathematically, spammers already have a near 0% response rate.

Some basic math: any finite number divided by infinity is zero.
Spammers can send, literally, infinite numbers of spam messages for very little cost to themselves.
If they get *1* sale out of infinite spam messages, they make a profit.
1/infinity = 0.
Therefore, spammers make money if they get a 0% response rate. Perfect business plan.

Re:Only one way to be sure

[Anonymous Coward]

Alternatively, they could autogenerate a reply for say, 1 month saying "Your Spam has been received by a US DOD computer. This is a courtesy warning. Further spam attempts will be met with unfortunate consequences. You have been warned.". After a month, choose several random spammers as targets to "test the efficacity of our cyberwarfare teams", a perfectly valid military excercise. I think the message would then be received, as computer networks go down and lose the spammers a fair bit of money because the nations top hackers are being encouraged to play with them....

Re:Only one way to be sure

[Anonymous Coward]

Spammers can send, literally, infinite numbers of spam messages

You keep using that word. I do not think it means what you think it means.

Re:Only one way to be sure

[zorro-z]

I know *precisely* what it means. Do you?

Re:Only one way to be sure

[beadfulthings]

I've experienced a recent oddity. My public gmail account still traps and disposes of the usual range of adverts for pilules, fortunes from various dubious sources, and enlargement schemes. My business address has been suddenly deluged with adverts for otherwise-legitimate products; for example, garden plants and seedlings from known nurseries; "art" tchochkes from various "limited edition" emporiums, and golf and fishing equipment, and camping gear from known sporting-goods outlets. My server traps and black-holes enormous amounts of spam. This stuff is sneaking through.

Re:Only one way to be sure

[Zantetsuken]

Even cooler, use kinetic bombardment weapons

The most described system is 'an orbiting tungsten telephone pole with small fins and a computer in the back for guidance.' The weapon can be down-scaled as small as several meters long, an orbiting "crowbar" rather than a pole.

The time between deorbiting and impact would only be a few minutes, and depending on the orbits and positions in the orbits, the system would have a world-wide range. There is no requirement to deploy missiles, aircraft or other vehicles. Although the SALT II (1979) prohibited the deployment of orbital weapons of mass destruction, it did not prohibit the deployment of conventional weapons.

The weapon inflicts damage because it moves at orbital velocities, at least 9 kilometers per second. The amount of energy released by the largest version when it hits the ground is roughly comparable to a small nuclear weapon or very large conventional bomb. Smaller weapons can deliver measured amounts of energy as small as a 500 lb conventional bomb.

The "pole" shape is optimal because it enhances reentry and maximizes the device's ability to penetrate hard or buried targets. The larger device is expected to be quite good at penetrating deeply buried bunkers and other command and control targets. The smaller "crowbar" size might be employed for anti-armor, anti-aircraft, anti-satellite and possibly anti-personnel use.

The weapon would be very hard to defend against. It has a very high closing velocity and a small radar cross-section. Launch is difficult to detect. Any infra-red launch signature occurs in orbit, at no fixed position. The infra-red launch signature also has a small magnitude compared to a ballistic missile launch. One drawback of the system is that the weapon's sensors would almost certainly be blind during reentry due to the plasma sheath that would develop ahead of it, so a mobile target could be difficult to hit if it performed any unexpected maneuvering.

Also, I'd imagine that would be less expensive than actual nukes, since while you still need the rockets and cost of fuel might rise since launch mass increases, at least you don't have to spend money on making and maintaining nuclear warheads with such weapons...

Re:Only one way to be sure

[luigi517]

make them come pick up the prize or whatever they've won and beat the hell out of them there

Re:Only one way to be sure

[AKAImBatman]

After a month, choose several random spammers as targets to "test the efficacity of our cyberwarfare teams"

You assume that spammers have a network to attack. I assure you, they do not. All this spam is coming from large networks of zombie machines. To launch a cyberattack on the source of the spam would effectively be a scorched Earth tactic. It might get rid of your spam, but it will also get rid of the architecture you're defending...

Re:Only one way to be sure

[Hurricane78]

I say spammers are natural selection at work. Let them be. As long as it takes power away from the retards, it's a good thing. ^^

Re:Only one way to be sure

[Hurricane78]

This one's simple: They are sufficiently new and different enough for the bayesian filter no not declare them spammy* enough.

* Yes, I just made that word up, and I'll sue you if you do *not* use it. ^^

Re:Only one way to be sure

[frosty_tsm]

Spammers can send, literally, infinite numbers of spam messages

You keep using that word. I do not think it means what you think it means.

-1

In discussions about very large numbers, "infinite" can be applied to numbers so large they might as well be infinite.

Re:Only one way to be sure

[vertinox]

You keep using that word. I do not think it means what you think it means.

I think he means long term. Assuming long as there is an internet, spam will still be sent infinitely.

Possibly long after the sun burns out and heath death starts to kick in.

Perhaps we will have spam filters large as Jupiter in the future to deal with the intergalactic spammers trying to sell hapless aliens anti-black hole kits.

Re:Only one way to be sure

[Anonymous Coward]

Infinity is not a real number. You can not divide a real number by a non-real number.

Re:Only one way to be sure

[Aranykai]

In which case the proper word would be indefinitely.
Something that lacks a definable limit is not inherently infinite.

Re:Only one way to be sure

[ailnlv]

given that you are stating that using finite time and resources spammers can send an infinite amount of emails, then I'd say that you don't really know what "infinity" means. Either that or you don't know what "literally" means.
Last time I checked, finite but very large is still a lot smaller than infinite.

Re:Only one way to be sure

[Anonymous Coward]

I think the spam problem could be solved by the ISPs. The majority of spam is sent via worms/viruses installed on people's home computers. For the most part, people use web mail like Gmail or Yahoo. For the ones that don't, and like to use Thunderbird or Outlook Express and use SMTP/POP, ISPs can create filters that only allow 1 SMTP message to be sent every second or so. The average user would not notice, because you generally don't send out a whole bunch of emails that quickly. A spam-spreading worm, however, can send out thousands of SMTP emails a second, so a filter like this would severely hamper the virus' ability to effectively send spam, and make it not worthwhile.

Queue the flood of responses saying that ISP should not be the Internet police, blah blah blah. It will only serve to help them, by lessening the amount of traffic going across their data lines, leaving more bandwidth available for legitimate web traffic. Hell, they could even make it an opt-in service, so that the user gets the choice of whether or not they want to help solve the problem of Internet Spam.

Re:Only one way to be sure

[Aggrav8d]

1. Have the spammers declared "illegal enemy combatants" or "network terrorists".
2. Rendition them to afghanistan
3. ?
4. Profit.

Re:Only one way to be sure

[Richy_T]

Let's move on to the word "literally" then.

Re:Only one way to be sure

[Richy_T]

6i/2=3i

Re:Only one way to be sure

[Richy_T]

I mean

6/2i=-3i

Re:Only one way to be sure

[Richy_T]

How did we manage to get to where "Weapon of Mass Destruction" became a Euphemism for ABC weapons and not a weapon that causes massive destruction?

Re:Only one way to be sure

[ushering05401]

So how bad did I screw up my nephew when I convinced him that Buzz Lightyear was wrong... that, in fact, one could not go 'to infinity and beyond.'

Re:Only one way to be sure

[Tanktalus]

The poor kid has an uncle who is on /. - I'm not really sure the poor kid had a chance to begin with.

Re:Only one way to be sure

[Anonymous Coward]

not for small values of infinity...

Re:Only one way to be sure

[Anonymous Coward]

"heath death"

Too soon!

Re:Only one way to be sure

[Anonymous Coward]

i do not think that prefix means what you think it means.

infinite != infinity. infinite is not finite, as in not limited (read: undefined)

Re:Only one way to be sure

[geekoid]

Incorrect.

Infinite can just mean an extremely large unknown number.

read up
http://en.wikipedia.org/wiki/Infinity

Re:Only one way to be sure

[Anonymous Coward]

No it can't, there is no number large enough it "might as well be infinite".

Re:Only one way to be sure

[jc42]

Spammers can send, literally, infinite numbers of spam messages
You keep using that word. I do not think it means what you think it means.

In discussions about very large numbers, "infinite" can be applied to numbers so large they might as well be infinite.

Actually, you made the same mistake as the others here. The OP could well have known what "infinite" means, but obviously doesn't know what "literally" means.

The OP made a perfectly good metaphorical use of "infinite"; the only problem that only the metaphorical meaning makes sense, since the spam can't very well be literally infinite.

Now I'll literally go away and play grammar nazi elsewhere ...

Re:Only one way to be sure

[jonbryce]

I think you'll find most ISPs already do this, and the zombies self-limit the spam they send out to get round this.

Re:Only one way to be sure

[Frosty Piss]

I'm convinced that the only real solution to spam is to find the people who are stupid enough to buy the products offered via spam and beat the ever living shit out of them. The spammers wouldn't keep doing it if people didn't keep buying their shit...

Basically the southern US.

Re:Only one way to be sure

[Anonymous Coward]

In discussions about very large numbers, "infinite" can be applied to numbers so large they might as well be infinite.

Luckily, if you mean infinite as in unending, then we have a word you can use: "literally".

Wait...

Re:Only one way to be sure

[The Snowman]

The real reason you keep receiving spam is that there is a almost endless stream of new companies that can be tricked into believing that sending spam would be a cost effective way of advertising there product.

It is not even that. I have accosted companies that left reliable contact information in my spam several times. Each time, they did not know (or claimed not to know) that they were spamming. Instead, a "marketing" company offered to help them "advertise on the internet." They claimed to be unwitting bystanders in the process. In one case, I verified that I stopped receiving their spam. Other times, not so lucky. Some of them were probably spammers themselves, some were probably innocent. Either way, it is not so easy to paint them all as having the same motives.

Re:Only one way to be sure

[mokus000]

Some more basic math: zero != near zero

Some basic physics: Spammers *cannot* send literally infinite numbers of spam messages, for any cost.

Some basic economics: "very little cost" != "no cost".

Some basic statistics: You don't get to determine the actual response rate by dividing actual responses by the potential number of messages you claim they *could* send, even if that number was somehow right.

Some basic logic: The fact that your argument gives a particular conclusion (namely, that 1 or more sales out of an infinity of attempts is a 0% response rate) does not mean that the converse holds (namely, that a 0% response rate means that there was 1 or more sale).

Re:Only one way to be sure

[Imrik]

"The amount that they can send is effectively infinite" is very different from "The amount they can send is literally infinite."

Re:Only one way to be sure

[jo42]

Nuke spammers from orbit.

You realize that the chances of missing from orbit are greater than hitting...

Re:Only one way to be sure

[Ortega-Starfire]

This is why you use a NUKE. Oh darn, I didn't hit the target exactly dead on. I was a quarter mile off. Wait, a 2 megaton warhead just went off. Target destroyed.

There is a reason why nuking from orbit really is the only way to be sure...

Re:Only one way to be sure

[Anonymous Coward]

"Stupidity cannot be cured with money, or through education, or by legislation. Stupidity is not a sin, the victim can't help being stupid. But stupidity is the only universal capital crime; the sentence is death, there is no appeal, and execution is carried out automatically and without pity."
Robert Heinlein
Time Enough For Love.

Re:Only one way to be sure

[jc42]

The OP made a perfectly good metaphorical use of "infinite"; the only problem that only the metaphorical meaning makes sense, since the spam can't very well be literally infinite.

Oops; I accidentally the verb out of that sentence. Is this dangerous here on /.? ;-)

I've been things on the interwebs too much, and I seem to have infected by one of the latest silly memes ...

Re:Only one way to be sure

[simcop2387]

Graham's number

Re:Only one way to be sure

[Frosty Piss]

It may be "flamebait", but it is also true.

Re:Only one way to be sure

[Mikkeles]

Na, just replace ' that' in '...the only problem that ...' with ':':)

Re:Only one way to be sure

[jc42]

Hey, you're right! That's very clever.

The only problem now would be: What percentage of the /. readership would/wouldn't understand this use of a colon?

Re:Only one way to be sure

[AScruffyI]

Eliminate spam through social engineering and nukes - why didn't I think of that? Spam exists because there's money in it, and the same is true for the solutions out there to counter it, extant and to-be-developed. Mankind has figured this stuff out, people - really. DISA will shop, they will buy, and if they choose wisely, they will kill their spam problem and get back to the business of saving the world, or whatever it is they do over there.

Not big...

[Anonymous Coward]

There are plenty of solutions out there that work on this scale. I worked at a company that did roughly double that, and now I work at a company that does well over 50 times that.

Off the top of my head, Ironport is probably their best choice.

its pretty simple

[goffster]

Establish a "fine" network.
Another mail network sends you spam?
You fine them.
They in turn fine whoever sent them spam.
Whoever does not pay then fine, gets turned off.

Re:its pretty simple

[Anonymous Coward]

Establish a "fine" network.
Another mail network sends you spam?
You fine them.
They in turn fine whoever sent them spam.
Whoever does not pay then fine, gets turned off.

Your post advocates a

( ) technical ( ) legislative (X) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
(X) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(X) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
(X) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:its pretty simple

[mokus000]

You forgot to check a few (and possibly others):

(X) It is defenseless against brute force attacks
(X) Requires immediate total cooperation from everybody at once
(X) Lack of centrally controlling authority for email
(X) Willingness of users to install OS patches received by email
(X) Joe jobs and/or identity theft
(X) I don't want the government reading my email

I'd also add one not on the form:

(X) No objective standard for what is and is not spam.

Ten dollar tent

[oldhack]

I hope they don't shoot $10M cruiser missile to take out $10 tent housing Packard Bell botnet control center.

Re:Ten dollar tent

[Seakip18]

You're right. We need to use a MIRV ICBM. We'd nuke multiple sites from orbit. It's the only way to be sure.

Re:Ten dollar tent

[K. S. Kyosuke]

Multipath antispam? I like that.

The military?!

[osgeek]

Great, and then there will be secret abductions of spammers who are sent to Guantanamo without trial or hope of quick appeal. There will be water boarding and sleep deprivation and acts of humiliation.

Really, I think that my point is that it's not severe enough.

Re:The military?!

[mokus000]

Get the Mythbusters to find the optimal method. That bamboo-shoot-growing-through-the-chest thing looked promising.

Re:The military?!

[fbsderr0r]

IS that a bad thing for spammers? They rank up there in my book with Hitler, Stalin, and Snidely Whiplash.

Router level solution

[ArcherB]

I don't understand why routers can not be programed to limit the number of emails it receives from a single source. For example, if a router detects that 10,000 emails are coming from a particular host, treat that host as if it's perpetrating a DOS attack. Routers can be programmed to ignore DOS attacks, why not use the same tech to block massive spamming?

Re:Router level solution

[Jah-Wren Ryel]

Because spam doesn't work that way anymore. It comes from botnets where each individual zombie only sends one or less messages to the target and need only send out 20 or 30 each day total to still be effective.

Re:Router level solution

[epiphani]

That's because you want a router to do something it doesn't care about. That would require full layer 7 visibility on the router - then it wouldn't be nearly as good at doing what its supposed to: routing.

Most routers rarely look above layer 3. Occasionally they'll do some layer 4 stuff, but that is best left to firewalls or load balancers.

Also, routers aren't programmed to ignore DOS attacks. They're programmed to ignore very specific types of DOS attacks, sometimes.

Re:Router level solution

[SBrach]

If only it were as simple as "Host X sends spam -> block Host X." The problem is n clients of host X are zombies sending spam while the other y clients are legitimate users. So, sure, you can block my ISP because of the clients that are sending you spam, but then I couldn't send you an E-Mail either, and I actually DO know the secret to penis enlargement.

Re:Router level solution

[A beautiful mind]

Your post advocates a

(X) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(X) Infrastructure costs that are involved in deep packet inspection on the core routers
(X) Privacy concerns in letting ISPs perform deep packet inspection on the core routers
( ) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
(X) Countermeasures should not involve sabotage of public networks
(X) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(X) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Router level solution

[ArcherB]

Because spam doesn't work that way anymore. It comes from botnets where each individual zombie only sends one or less messages to the target and need only send out 20 or 30 each day total to still be effective.

First, I wonder about the 20-30 messages a day bit. There are roughly 150 billion spam messages sent daily. There are 6 billion people on the planet. In order for your 20-30 messages a day number to be correct, that would every man, woman, and child on the earth would need a computer and every single one of them would be part of a botnet.

Next, if we are assuming that your 20-30 number is correct, I assume many of these messages are identical or similar enough to be identified. I know I get several repeat messages in my GMail spam box every day. There are only so many routers that lead into the US. Set these up to monitor email traffic (is it port 22? 25? I don't remember)... and look for patterns. If the same email is being sent 20 billion times, you can bet it's spam, block those hosts until they can show they are not longer spamming, even if it's a million machines that are part of the bot-net.

As for domestically generated spam, track them and let local law enforcement hand them.

This will require funding, of course, but if you tax the companies that would benefit from this, they will end up spending less in the long run.

Re:Router level solution

[jgardia]

i think it would be easier if the ISPs start blocking any email coming from non-corporate users. If you want to have an email server at home, ask your ISP to unblock the port. Then, all the grandma-zombie-computers will be unable to send spam.

Re:Router level solution

[i.r.id10t]

Whats the difference between legitimate listserv messages and spam in your scenario?

Re:Router level solution

[ArcherB]

Would it really require "full layer 7 visibility on the router" to count the number of port 25 messages coming from each host? I would assume the biggest problem would be the memory involved in counting the messages and keeping that count in RAM for each and every host, keeping track of which hosts are blocked by each router and every other router (national database) and securing the system so that some hacker can't get in there and put every Microsoft IP into the black-list.

Still, I don't see these problems as being insurmountable. It also doesn't have to be the routers that do the packet inspection. We could set up machines at various choke-points on the web to take care of this. If we can route every phone conversation through a closet at AT&T for a government spy program, surely we can work this out.

Re:Router level solution

[ArcherB]

Whats the difference between legitimate listserv messages and spam in your scenario?

Excellent question. Companies that send out legitimate mass emails would need to be added to an "allow-list".

I know, it sux, but the benefit of no spam outweighs the pain of asking legit listserv's to register.

Re:Router level solution

[Jah-Wren Ryel]

First, I wonder about the 20-30 messages a day bit. There are roughly 150 billion spam messages sent daily. There are 6 billion people on the planet. In order for your 20-30 messages a day number to be correct, that would every man, woman, and child on the earth would need a computer and every single one of them would be part of a botnet.

You make the error of assuming spam sending is distributed evenly. Compromised systems at large corps and government offices can easily send many orders of magnitude more spam and still get lost in the noise of legit email from their sites.

There are only so many routers that lead into the US, set these up to monitor email traffic (is it port 22? 25? I don't remember)... and look for patterns.

That's an increase in workload that is many orders of magnitude larger than what even the largest routers do now. Furthermore, the US has the second highest zombie infection rate in the world, so border routers aren't all that useful and sending the cops after people with zombied computers is impractical. They are millions and they aren't standouts.

(a) Hard to detect a lot of sources because they are lost in the noise
(b) Extremely expensive to do pattern matching on all mail traffic
(c) Cops don't have the resources

If the problem were easy, it would have been solved.

Re:Router level solution

[ionix5891]

I know, they can pipe their email thru' Gmail ....

  oh wait, nvm :P

Re:Router level solution

[value_added]

I don't understand why routers can not be programed to limit the number of emails it receives from a single source.

If you're asking whether a router can can impose limits such as the number of simultaneous connections allowed from a given host, or the rate at which new connections are established, then yes, that's perfectly do-able and good sense for not just SMTP traffic. Restricting the receipt of email messages, however, is a very different problem as has already been pointed out. That's not to say that email servers are completely lacking features that can help (Sendmail's ratecontrol, for example).

My own observation, however, is that spammers tend to be more well-behaved these days so these kinds of solutions, while helpful, aren't the solutions you're looking for. ;-)

Re:Router level solution

[Anonymous Coward]

Best post ever.

You are a God among men.

Go ahead and mod me down, it was worth the read.

Re:Router level solution

[ArcherB]

(X) Mailing lists and other legitimate email uses would be affected

Legitimate mass mailers would require a registration to be placed on an allow list. Of course, spammers need not apply. Licensing fees could even be charged for this list to pay for the program, but that may not be fair.

(X) Many email users cannot afford to lose business or alienate potential employers

Like who? Spammers? If you send less than, say, 10,000 emails a day, you shouldn't have to worry about anything. If you do legitimately send that many emails, see my response to your previous complaint.

(X) Open relays in foreign countries

How many "pipes" are there at US borders? Put filters on all of these.

(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes

Machines that have been zombiefied would be cut off from the web at the router level. They will be allowed back on once their ISP can verify they have been de-zombied.

(X) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam

That's why this is based on the number of emails sent from a particular host. The profitability of spam comes from the raw numbers of emails sent per host. Cut that number to a relatively insignificant amount and the numbers of successfully received spam emails drops significantly, making it much less profitable.
The only way around this would be to zombie so many machines that the spammer could spread the number of hosts emailing so that no single host will raise alarms. With 150 billion spam emails sent daily, there is no way that spammers could spread this out far enough without taking a severe hit in the number of messages sent. Which leads to lower profits... wash, rinse, repeat.

(X) Infrastructure costs that are involved in deep packet inspection on the core routers
(X) Privacy concerns in letting ISPs perform deep packet inspection on the core routers

Why not just use the same setup the previous administration did to monitor phone calls? If we can pipe all of America's phone calls through a closet at an AT&T building, surely we can set up a few monitoring stations to look for traffic on port 25.
Cost could be paid for by the companies that pay so much to fight spam today. With the reduction in web traffic and email data storage, the system would pay for itself many times over.

(X) I don't want the government reading my email

Since the emails are counted instead of read, there would be no privacy concerns.

(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical

Examples?

(X) Countermeasures should not involve sabotage of public networks
(X) Countermeasures must work if phased in gradually

???

(X) Sorry dude, but I don't think it would work.

Not with that attitude!

Seriously though... I'm a geek, but by no means a networking expert. Most of my "solutions" to the problems you've brought up may not work at all, however, if I a mental midget like myself can at least dream up feasible solutions, then surely big boys at Cisco, Time Warner, AT&T, Sun, IBM and the rest backed with government stimulus dollars can surely find a way to secure our networks from within the networks themselves as opposed to the end point. This security by end user crap ain't cutting it.

Re:Router level solution

[woot account]

Hate to burst your bubble, but http://craphound.com/spamsolutions.txt.

Re:Router level solution

[dkleinsc]

As a sibling post pointed out, this checklist is used whenever there's discussion of solutions to the spam problem.

(X) Mailing lists and other legitimate email uses would be affected

Legitimate mass mailers would require a registration to be placed on an allow list. Of course, spammers need not apply. Licensing fees could even be charged for this list to pay for the program, but that may not be fair.

What if I'm a legitimate mass mailer who, say, wants to organize political protests? Who may not want their activities on a government list?

(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes

Machines that have been zombiefied would be cut off from the web at the router level. They will be allowed back on once their ISP can verify they have been de-zombied.

How long do you think AT&T and other broadband ISPs would put up with this? All the customer sees is "My Internets is broken. $ISP sucks, I'm switching." Also, if there's a 10000 per host limit (over a particular period), 9999 * 10 million is a pretty significant chunk of spam.

(X) Infrastructure costs that are involved in deep packet inspection on the core routers
(X) Privacy concerns in letting ISPs perform deep packet inspection on the core routers

Why not just use the same setup the previous administration did to monitor phone calls?

Because it's illegal under wiretapping laws, for starters.

(X) I don't want the government reading my email

Since the emails are counted instead of read, there would be no privacy concerns.

Using the example of a non-profit group, the government now has a count of the size of everyone's email list. Or has a much shorter list of who to look at for who's running the email server of a political group.

Re:Router level solution

[jra]

I'd forgotten about this form letter; thanks. I needed a laugh on a Friday afternoon...

Re:Router level solution

[Omniscient Lurker]

You're basically giving ISPs an excuse to charge more money. "Sure you can have a Email server, just pay $39.99 for the first three months then $69.99 after that."

Re:Router level solution

[Hotawa Hawk-eye]

Companies that send out legitimate mass emails would need to be added to an "allow-list".

Who defines "legitimate"? I'm sure that (if they could get away with it) some people at Microsoft would say that messages to the Linux Kernel Mailing List or from Apple are not legitimate mass emails, and I'm sure there are some fanatic followers of Linux or Apple who would say the same thing about any emails sent out from Microsoft.
Who determines which companies are allowed on the "allow-list"?
Can companies be removed from the "allow-list" if they start spamming?
Who pays for maintenance on the "allow-list"?

I know, it sux, but the benefit of no spam outweighs the pain of asking legit listserv's to register.

It doesn't "sux[sic]", in my opinion it's unworkable because it requires someone that everyone trusts -- and there's no such person.

Re:Router level solution

[Anonymous Coward]

Really, it's not a surprise but either nobody read the article or nobody understood it. It sounds like they're talking about doing this on the perimeter of the NIPRNET, as in this would be for killing spam messages addressed to government systems. We have a pretty bad problem with this right now, some of us get 20-30 a day that get past the filters, and thousands per user that are getting filtered out, it's really hammering our (poorly built) networks. As flawed as the ideas are this won't touch the public internet.

*posted from a NIPRNET machine*

Re:Router level solution

[epiphani]

Also, not how SMTP works.

Counting connections themselves is pretty near useless, as SMTP is designed to allow single connection to dump large amounts of separate email. Often cases you'll have SMTP connections from places like hotmail or gmail connect once and dump dozens/hundreds/thousands of emails. This happens even more for mailing lists.

It can be done, but not at the router level. This is why appliances such as Ironport exist.

Re:Router level solution

[Anonymous Coward]

Your post advocates a
(x) Checklist () Thoughtful rebuttal () Moderation () Flaming
approach to posts that you disagree with. Your approach is lame. Here is why it's lame. (One or more of the following may apply.)
(x) It is very tired and old and cliche, must less amusing than it was 15 years ago
() It takes effort to write a thoughtful rebuttal or flame
() You don't always have modpoints when you need them
() Metamoderators will punish you
(x) It makes you seem arrogant and condescending, not to mention lazy
() You never know when someone will take a flame personally
(x) It doesn't help with the discussion at all
() The brilliantly-coded and utterly perfect lameness filter will catch it every time and with no false positives, such that Malda's godliness and infallibility ends up distracting everyone from the actual issues of the discussion
(x) Ok so maybe it's kind of fun to do, but it's still lame

Re:Router level solution

[alohatiger]

How do you send less than one message to a target?

Re:Router level solution

[Jah-Wren Ryel]

How do you send less than one message to a target?

Its called "zero." You may have heard of the number, its been around for quite a few centuries now.
As in not all zombies in a single botnet will necessarily spam all targets.

Re:Router level solution

[geekoid]

There is a legal definition to SPAM, so I could want to send out, say a million political email, it isn't considered spam.
SO basically you are cutting an avenue for political speech.

And no, I don't give a crap about your definition of SPAM. Wide scale Solutions must only consider the legal definitions.

Of course your sig certianly implies an inability to think beyond what ever thing happens to pop in your head, so I don't expect expect your idea to be well thought out.

Re:Router level solution

[jonbryce]

The first question is easy. They are legitimate mass emails if they are only sent to people who ask to receive them. All the people you mention fall into that category, so they are all legitimate.

Re:Router level solution

[jonbryce]

I pay £5 per month for a static IP address. That means I'm not in the dynamic IP pool that is blacklisted by a lot of people. Surely that is the same thing?

Re:Router level solution

[daradib]

Spammers could relatively easily make each spam email unique by changing small bits (like characters or words) of the message. Accounting for these would probably generate a lot of false positives.

Re:Router level solution

[Anonymous Coward]

At $100 million I can probably do it. I need somewhere around 1400 email gateway boxes... me and a couple of buddies can do this in a weekend or two. And I would have around $90 million to spare.

Re:Router level solution

[mokus000]

but then I couldn't send you an E-Mail either, and I actually DO know the secret to penis enlargement.

Maybe, but I'd still ignore it anyway.

Re:Router level solution

[ZachPruckowski]

You can't "count the port 25 messages from each host". As others have said, in a botnet, each computer needs only send a dozen emails an hour. That falls within the "heavy email use" normal range for some people.

Additionally, how is your router going to know whether it's got one computer behind it, or a NAT with 100 computers?

Re:Router level solution

[salimma]

There are only so many routers that lead into the US. Set these up to monitor email traffic (is it port 22? 25? I don't remember)... and look for patterns

But an email message might be cut into multiple packets, and the router might not see the entire message. This poses several problems:

- dropping a packet means it will be re-sent, probably through a different, non-filtering router

- the sender might readjust its MTU repeatedly to make sure that the spam messages get cut up differently each time, thus reducing substantially the number of exact matches

- even without these countermeasures, and simplifying to 1-packet short emails, this is expensive in both space (amount of memory needed to store suspect packets) and time (having to parse every inbound packet).

Re:Router level solution

[fulldecent]

Your post supplies a response to a spam-fighting approach which fails to realize the INCREMENTAL value of spam solutions, and specifically fails in the categorization of that approach into the following categories:

(X) Open relays in foreign countries
(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Extreme profitability of spam
(X) I don't want the government reading my email

However. Your other notes are completely valid.

Why bother with an IT solution?

[A beautiful mind]

Seriously, it's less than two dozen guys pumping out 90% of the spam in the world. I would guess that the law enforcements and militaries of the world should just do their jobs and apprehend these criminals.

I'd certainly appreciate real action like getting rid of spam than for the CIA/US Military to spend time chasing down far fetched terrorist plots. I'm constantly stunned that given the damage spam creates, special branches aren't more active in tracking and _eliminating_ the sources of these things.

Re:Why bother with an IT solution?

[TerranFury]

Seriously, it's less than two dozen guys pumping out 90% of the spam in the world.

Do you have a source for this? It's interesting...

Re:Why bother with an IT solution?

[MyLongNickName]

Since you cannot be bothered to look it up yourself, here is the source.

Re:Why bother with an IT solution?

[Anonymous Coward]

not quite 90 from 24 but here is one of the better maintained lists of the heaviest spammers: http://www.spamhaus.org/statistics/spammers.lasso from there full list of major spammers: http://www.spamhaus.org/rokso/index.lasso

Re:Why bother with an IT solution?

[Anonymous Coward]

It is a dozen ppl using millions of Windows box that have been cracked. Do you plan to murder all the window lusers?

Re:Why bother with an IT solution?

[Culture20]

I'm constantly stunned that given the damage spam creates, special branches aren't more active in tracking and _eliminating_ the sources of these things.

But no one yet understands the damage spam creates except for those of us with an IT bent. Back in WWII days and directly after, Radiation was your friend. It could do everything for the man of tomorrow! The first people to learn how dangerous it really was were the scientists getting really bad radiation poisoning and cancer. Even after that, it took a while for the public to switch from Radiation==Good to Radiation==NotGood, and even then, they over-simplified to the point that people still fear irradiated foods (which are not radioactive).

What we need are some public service announcements: "Unrequested mass mailings use our nation's internet bandwidth, reducing our GDP, making it easier for the terrorists to win, and have a carbon footprint equal to 5,000,000 cattle, a Rush Limbaugh, and a Michael Moore. You can do your part to help! Change your email default viewing to 'text only' so you don't load their images. Stop clicking on their links. Send them to your junk folder. Report them if your email system has a spam-reporting function. Like Spamsy the Cat says: 'I may be lazy, but even I can stop spam just by doing nothing!'"

Re:Why bother with an IT solution?

[A beautiful mind]

I was a bit off by saying less than two dozen, but I wasn't off by that much. Spamhaus says 200 heavyduty spammers are generating 80% of the spam in the world.

The numbers I had in my mind are an outdated estimate I've heard a couple of years back. It's good to remember to question information and it looks like I forgot about keeping my assumptions up to date...

Re:Why bother with an IT solution?

[Terrasque]

I can see it now.. An email to the people's private email address :

"Hello $full_name, $address.

This is a friendly warning from the new joint NSA/US Military anti spam campain.
We know where you live. We know what you look like. And now, we also got nukes.

Love, NSA/USMil"

I think that might be pretty effective, actually.

Re:Why bother with an IT solution?

[Shadow Wrought]

I would guess that the law enforcements and militaries of the world should just do their jobs and apprehend these criminals.

To go a step further, what happens if it can be determined that the spammers are enemy combatants waging war against the United States infrastructure?
In other news today, US Military Drones attacked 200 hundred spam headquarters in coordinated action last night. Anti-war protestors took the streets by the thousands to show their support...

Re:Why bother with an IT solution?

[Anonymous Coward]

I'd certainly appreciate real action like getting rid of spam than for the CIA/US Military to spend time chasing down far fetched terrorist plots.

What they need to do is trick the spammers into emailing out cartoon caticatures of Muhammad - that could solve both problems at once!

Re:Why bother with an IT solution?

[Ihmhi]

He's saying the guy is pulling stuff outta his ass, mods.

Geez, one Wikipedia mooning and the downmodding begins in full force.

Re:Why bother with an IT solution?

[CompMD]

Only 200? I buy 50 round boxes of 9mm for about $12/box. Spam is a problem that could be solved for $50.

Re:Why bother with an IT solution?

[mgabrys_sf]

Just have ICANN delist, revoke, ignore, Nigeria. They're all rich royalty anyway - why do they need the internet anyway.

Re:Why bother with an IT solution?

[geekoid]

Who would be replaced in minutes.

Re:Why bother with an IT solution?

[geekoid]

Why does everyone think these people don't ahve security?
I dare you to try and shoot one of these bozos.

Re:Why bother with an IT solution?

[geekoid]

Well, you are clearly over the top, but the best way to fight spam is with education.
Don't pass it on, recognizer something questionable, what to do if you gt something questionable, and some things you can do to prevent SPAM.
No product recommendation from any for profit Anti-virus/spam products.

Re:Why bother with an IT solution?

[Bluesman]

I'm dying to know what the extra $2 is for. Convenience charge?

Re:Why bother with an IT solution?

[mikael_j]

Actually, from what I've seen from browsing Special ham and a few other forums it seems that most of these guys are just random, as you put it, bozos working out of their homes. While there is no doubt a few of them have connections to organized crime they're still mostly just random guys with just enough computer skills to pull off the crap they're doing.

tl;dr These are hardly hardened mafiosos.

/Mikael

Re:Why bother with an IT solution?

[DeepBlueDiver]

I like the way you think.

Re:Why bother with an IT solution?

[Anonymous Coward]

it's less than two dozen guys pumping out 90% of the spam in the world.

Where is that Navy SEAL sniper team when you need them? If a few of those spammers were found slumped over their keyboards with single-round headshots then maybe the rest of them would take a hint.

Re:Why bother with an IT solution?

[dodobh]

The problem is that DNSBLs killed the spammers sending mail from their own infrastructure. Now it's all the Windows PCs affected with trojans, bots and viruses which are sending out spam.

The military can't just attack everyone with a compromised PC, because there are too many of those. NAT gateways make things even worse.

Unclassified?

[Culture20]

If it's not classified, hire a few companies in India or China to do non-artificial intelligence spam filtering. Problem solved.

Re:Unclassified?

[L3370]

because they need to maintain ultimate control of who has access to the info. Imagine if someone had accidentally slipped classified material onto an unclass system. Now that material would be filtered through numerous companies outside of the U.S?

Isn't this a solved problem?

[russotto]

There's already spam-blocking and virus-scanning firewalls out there. This seems like the perfect problem for a COTS (Commercial-off-the-shelf) solution.

Although I do agree with earlier posters that it would be infinitely more satisfying if they sent the military after the spammers instead... they could take a middle ground between arresting them and torturing them, and just shoot them.

Re:Isn't this a solved problem?

[fishbowl]

>There's already spam-blocking and virus-scanning firewalls out there

I never got more spam than when I was behind a "Barracuda".

I never saw less spam than when I started using Gmail.

I persuaded my company to move our mail (@ourdomain) to gmail. It doesn't seem to be well known that you can use Gmail with your domain name, and they provide imap access for clients.
It's a very cost-effective solution.

should be a simple enough solution

[jollyreaper]

They have lots of men with thick necks and big guns. Buy some plane tickets and pay a visit. Make 'em an offer they can't refuse.

The US Military already has a solution.

[Lilith's Heart-shape]

In fact, they have several: the Green Berets, the SEALS, and (depending on whom you ask) the whole fucking United States Marine Corps. Turn 'em loose on the spammers.

Re:The US Military already has a solution.

[Anonymous Coward]

Actually Green Berets are only the Airborne Division. So you are saying you want a cook with a gun who can jump out of an airplane taking out spammers? That sounds like the plot for a new FPS game!

Back to the original topic, you have Rangers and Special Forces(black berets), then the rest you mentioned.

Re:The US Military already has a solution.

[Anonymous Coward]

not to mention Delta Force, 24th Special Tactics Squadron, Intelligence Support Activity, 160th Special Operations Aviation Regiment (Airborne), 352d Special Operations Group,1st Special Operations Wing, among others but for this application the 3 that are probably best suited are

Intelligence Community Special Units

        * Strategic Support Branch (CIA/DIA)
        * Special Activities Division (CIA)
        * Special Collections Service (NSA - CIA)

particularly the Special Collections Service which boasts a wikipedia page that looks small enough to be a twitter post and basically says "CIA + NSA == worse than extraordinary rendition

Re:The US Military already has a solution.

[Anonymous Coward]

I'm sure the 352nd appreciates the shot-out, but I don't think you know wtf you're talking about.

Bounce confirmation whitelist

[Co0Ps]

I know a workplace where they set up a bounce-and-confirmation system, so that mail from non-confirmed e-mail addresses was bounced, asking to reply if this was a real human. When it got the reply, the address was added to a whitelist. The person working there said to me that he got zero spam after the implementation. Probably becouse almost all spam has a forged from header and/or is not able to receive and reply to incoming mail.

Re:Bounce confirmation whitelist

[Culture20]

The only military email system that I've sent mail to used this, and some sort of system similar to /.'s Lameness filter. It took me three emails to get one message to one recipient. Annoying as Hell, and I almost gave up. Did the person you talked to give numbers on how much real messages were reduced?

Re:Bounce confirmation whitelist

[Anonymous Coward]

What you're referring to is called [a href=http://www.greylisting.org/]greylisting[/a]

Re:Bounce confirmation whitelist

[RazzleDazzle]

Oh, so you are now a source of spam and back scatter since every single email address that sends a message to you (forged or otherwise) you reply to it as it were a legitimate message. Thanks for contributing to the problem and making it more likely I will not ever contact you via email. One of the reasons e-mail became so heavily used and therefore depended upon is the ease of communication. If you require a manual or auto (like yourse) moderated permission to communicate I guess I will just have to go to your competitor with whom I more easily communicate with.

Re:Bounce confirmation whitelist

[timeOday]

One of the parents on a soccer team I was coaching had that. There was some glitch, and I started trying to work through their crappy system until I thought, "why should I go to this extra effort for somebody else's convenience?" So I didn't.

Also, a friend's yahoo account was compromised, so I started getting email "from him" (except not really). Not even whitelisting protects you then. (But the worst part was, my "real" email address was in his contacts list, so after 7 solid years, it was compromised. Game over!)

Re:Bounce confirmation whitelist

[RexDevious]

This can be fixed with "white words" - certain things that are unique enough to the type of email that you might get to be considered a pre-confirmation. This is particularly important for getting electronic receipts - as the servers sending those out aren't going to participate in a challenge response. But they're pretty likely to have used something like your name, zip code, or other piece of text you don't find in Spam very often.

Likewise, using a subject line code word can allow humans to send more general email with no challenge response. These can be put in email links too, until email harvesters start recording those subject line words, and update them as often as you update yours.

But most importantly, the "Reply to this challenge email" only works until more than one person on earth builds such a system. As I quickly found out when my Challenge Response system got email from an email account with a BoxTrapper behind it - which either results in false confirmation (reply alone is accepted as proof), or an endless loop of challenges between the two systems(reply must contain a certain word in the subject, but is only mentioned in the body). Which is why my challenge is not to do something a computer is apt to do anyway.

Seriously, it's ridiculously easy to figure out if some communication is coming from a human. Like those new alternatives to captchas that just ask people to perform incredibly easy tasks (eg. "type the answer to one plus one in the box below"). Yes, there are people who are so dumb even *they* couldn't pass a simple Turing Test... but do your really want get emails from people like that?

Re:Bounce confirmation whitelist

[dodobh]

The Challenge Response Authentication Protocol is crap. Most humans don't answer the question either, and just go away. Some of us block the sender as a spammer.

Re:Bounce confirmation whitelist

[geekoid]

That's old school. Considering the from address is usually faked in suck large quantities, you will get SPAM from people on your whitelist.
This was a good solution years ago, and it's is a good step now, but it's effectiveness is limited.

Wouldn't it be nice?

[erroneus]

For this rare instance I would certainly condone a few black ops. Find the people who are responsible, capture them, torture them and if they are bad enough, kill them. When there is money involved, it should be trivial to follow that money back to the people who collect it.

This also gives me a great idea for a movie sequel to "Taken." '...I have a very special set of skills... I will find you and I will kill you.' '//good luck//'

Yeah, I would totally watch that...

Re:Wouldn't it be nice?

[TheCarp]

The responsible part of me wants to say this isn't an appropriate use of the military.

The email user in me wants to make sure this "black op" sends them some place where torture is legal.

-Steve

Re:Wouldn't it be nice?

[Hurricane78]

Just take them to a US base. Duh. :P

Re:Wouldn't it be nice?

[QuantumRiff]

Its the same thing as with the whole "Extended car warranty" companies that have been violating the do not call list..

Why doesn't someone at the FTC just answer a call or email, and just give them a credit card number (that is arranged ahead of time with the CC companies) and follow the stinking money trail!?

Re:Wouldn't it be nice?

[TheCarp]

Yah, but the US bases only use the Wishy-washy tortures like stress positions (which, according to Army Lawyers quoted in the report on torture is probably a violation of the UCMJ and possibly torture)

I wanna see these guys put into iron maidens, and their balls shocked with electricity until they turn black and fall off. Slowly cut after cut administered to their skin.... oh yah take that spammers!

-Steve

Re:Wouldn't it be nice?

[Anonymous Coward]

I agree.

I'd also go after not only the spammers, but include the companies that they are promoting. It's easy enough to trace the money.

A large enough number of high profile examples would almost certainly deter any 'seller' from hiring a spammer service.

Face it these people are *Stealing* our bandwidth and time. Cut off their hands!!! Tattoo them as spammers, and go for the public execution.

Re:Wouldn't it be nice?

[halcyon1234]

You got modded funny, but you're correct. I've been saying this for years. They just need to take it one step farther.

Do as you say; hunt down the worst of the group, and make a gigantic, bloody, painful mess of them. Make sure every spammer knows this may happen to them, without further warning. BUT you've only taken care of part of the problem. Spammers will be more cautious, and the companies that sell their products through spammers will keep selling them.

So go after the market. No, not the sellers. The market. What does everyone say when the question "who the fuck buys from spam anyways"? They always say "Well, there's always that small percentage of idiots...". Fine. Take out the fucking idiots who are basically supporting these spammers. When you take down the largest spam net, capture their customer list. Send cyanide capsules marked as "v1agara" to each and every one of them.

I guaren-fucking-tee you, as soon as the headlines hit the news, the problem will be solved. "300,000 americans dead from poisioned pills bought by spammers". Not only will you kill the market for anyone who wants to sell because most of their clients are dead and the others are scared shitless, you'll also have a MASSIVE public outcry to "do something" about it. You'll get public funding and governmental go-ahead to continue the project. Not only will you get to hunt down and DESTROY the rest of the major operations, but you can do it with the public's money and blessing, and be hailed as heros.

Fuck the checklist, our genepool needs a healty dose of chlorine.

Re:Wouldn't it be nice?

[erroneus]

I think you overestimate the sensibility of those who are desperate for their "addictive needs." Addicts of more conventional high-giving drugs are more than well aware that even "the good stuff" can kill them. Overdoses and bad reactions (also called overdoses) routinely result in death and serious harm. It doesn't slow the use and abuse of such drugs. There are feelings more powerful than fear for these people. Some people are quite addicted to sexual experiences and I find THAT more interesting than anything else. There are large numbers of clinically "straight" men who are perfectly willing to engage in sexual acts with men just to experience whatever thing they want out of sexual experiences. (No, I don't speak from direct experience, but surprising information I discovered while trying to better understand homosexuality.)

What I have come away with is an understanding that there are certain types of people that are not a scarce minority of the population who are willing to throw away all logic and sensibility to get what they want. What they want can be just about anything... anything from junk food to sex to drugs/alcohol. There are people who, for example, are literally losing parts of their bodies because they will not regulate their diets!! We are talking about losing vision, fingers, hands, arms, toes, feet and legs because they just HAVE to have foods that are bad for them which their bodies can no longer tolerate. There are people who are well aware of the risks of anonymous sexual encounters, have suffered some of those consequences, and go back for more! If these types of people could die more than once, they would.

I know these people exist and I see clear patterns in the defects that manifest themselves in their personalities. But I am not really any closer to having any true understanding of how it happens or why. Unfortunately many things in nature can be identified but never understood. But I can say without reservation that the same people who can discard all logic and sensibility in the pursuit of their addictions are also the same people who can be "deeply" and maniacally religious and faithful. It largely comes down to uncontrollable emotions in people and so far, there seems to be no cure or even a diagnosis for this condition in people. But every seller, spammer, marketer, advertiser and religion has known for thousands of years exactly how to exploit this weakness in people for their own purposes.

And I will say it every day -- religion, especially organized religion, is built organized and maintained through the exploitation of the emotional weakness of large numbers of people. If you are "deeply religious" I urge you to take a really close look at how you have been exploited. You probably don't believe in "magic" and yet that is exactly what most modern religions expect you to believe. But I am drifting off-topic a bit here...

Substituting poison for drugs will not make any change in the demand for the drugs. The number of people may change, but that supply is always being replenished. "Risk" is no deterrent for people who are motivated beyond the bounds logic and sensibility. (And I have to say that while "faith" is the word used by some to describe it, it is still belief in [super-natural] magic beyond the bounds of logic and sensibility.)

In other words ...

[phoxix]

The military will spend a few hundred million with clearly efficient and excellent vendors like Lockheed Martin, and all of their spam problems will be fixed!!

NOT!

Here goes another few hundred million .... *sigh*

If we really believe in taxation without representation then my unborn baby should be able to vote already ...

Re:In other words ...

[Anonymous Coward]

The military will spend a few hundred million with clearly efficient and excellent vendors like Lockheed Martin, and all of their spam problems will be fixed!!

So you've worked with them too, huh?

Re:In other words ...

[L3370]

You have representation, so any taxation is just and in accordance to representation. Just because policy doesn't reflect YOUR opinion it doesn't mean that your opinion hasn't been given representation. If you didn't like your representation them you should have voted harder. :)

Re:In other words ...

[timeOday]

Obviously they will spend a bunch of money, and it won't be 100% effective. But if you have 5 million users, and it costs an average of $100/hr to keep each of them, a significant reduction in spam is worth paying good money for.

Simple Solution

[Anonymous Coward]

Just use gmail. gmail.mil

Re:Simple Solution

[fishbowl]

>Just use gmail. gmail.mil

You joke, but they do have a service where your domain's mx can be setup to use Gmail both for mx and for imap. I'm sure for a high-profile client, they could completely hide the fact that it's gmail. We have users who don't know they are on gmail. It's imap.ourdomain.com and smtp.ourdomain.com to them, and their users are name@ourdomain.com, not gmail.com.

Obligatory checklist

[dkleinsc]

The Defense Information Systems Agency advocates a

(X) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. The idea will not work. Here is why it won't work. (One or more of the following may apply to this particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(X) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
(X) Susceptibility of protocols other than SMTP to attack
(X) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
(X) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to this are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
(X) Blacklists suck
( ) Whitelists suck
(X) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
(X) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatibility with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
(X) I don't want the government reading my email
(X) Killing them that way is not slow and painful enough

Furthermore, this is what I think about them:

( ) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and they're stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Obligatory checklist

[Anonymous Coward]

Oh it's been at least few days since I last saw the Cynical Spam Solution Checklist here on Slashdot! Thank you!

Re:Obligatory checklist

[jra]

Interesting that the checklists don't match, isn't it? Does that say more about the problem... or the people (excuse me, this is slashdot: "guys") filling in the checklists?

Re:Obligatory checklist

[dkleinsc]

Well, we had a slightly different set of concerns. Of course, mine is redundant because I took 6 minutes longer in filling it out.

Mafia approach

[Anonymous Coward]

Seriously, it's less than two dozen guys pumping out 90% of the spam in the world. I would guess that the law enforcements and militaries of the world should just do their jobs and apprehend these criminals.

If it's really less than a couple dozen guys doing this, surely putting out contracts on their heads would cost substantially LESS than all the technical solutions combined to date?

revelation 12:7-12... apk

[Anonymous Coward]

"Nuke spammers from orbit." - by Archangel Michael (180766) on Friday May 15, @02:48PM (#27970781)

Revelation 12:7-12

Archanbel Michael (patron of policemen, iirc) Defeats the Dragon

And war broke out in heaven; Michael and his angels fought against the dragon. The dragon and his angels fought back, but they were defeated, and there was no longer any place for them in heaven. The great dragon was thrown down, that ancient serpent, who is called the Devil and Satan, the deceiver of the whole world; he was thrown down to the earth, and his angels were thrown down with him.

Then I heard a loud voice in heaven, proclaiming, Now have come the salvation and the power and the kingdom of our God and the authority of his Messiah,* for the accuser of our comrades* has been thrown down, who accuses them day and night before our God. But they have conquered him by the blood of the Lamb and by the word of their testimony, for they did not cling to life even in the face of death. Rejoice then, you heavens and those who dwell in them! But woe to the earth and the sea, for the devil has come down to you with great wrath, because he knows that his time is short!;

----

Doing MY part, here ->

----

HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA + make it 'fun-to-do', via CIS Tool Guidance (& beyond):

http://www.tcmagazine.com/forums/index.php?s=05af24090957cd14494a83460b92e853&showtopic=2662

----

"Nuff said..."

APK

P.S.=> No, I am not some "Holy Roller", I just saw the user's name & the topic @ hand, & felt it fit (in a way)... apk

Easy enough to do

[Groo Wanderer]

The thing that most people don't get is that the spammers are known. We know where they are, we know who they are, and how they work. Cash does get traced, and it can't be hidden all that well.

The problem is that most of these cretins are either in countries that have governments that don't care, have no laws against this, or have better things to do. In some cases, they are, or have purchased the government.

So, since we know who they are, where they are, and many of the details, the solution is simple.

The US military has lots of guns and people trained to use them. If these people start showing up somewhat decomposed with a can of Spam (the meat-like product) in their mouths, people will get the message. Toss complicit ISPs in there, and viola, for the cost of a few bullets, spam goes away.

The only reason it is prevalent is that there is no down side to it. If people who advertised on it, stuffed it out there, or facilitated it's transfer start tipping up dead, well, things change quick.

Until then, basically they are smarter than you, have more time than you, and will beat any filter you put into place.

Any other questions?

        -Charlie

Re:Easy enough to do

[jra]

"You can be a cop or a soldier, not both"

Don't send police to do the military's job, then?

Give way to an open source solution... Untangle!

[Swampcritter]

Untangle (www.untangle.com) -- Free Spam Blocker enables administrators to block spam at the gateway before it ever reaches the users.

* Leverage the best spam filtering techniques including Bayesian Filters, Razor, realtime block lists (RBLs), OCR for image spam and tarpitting

More Info: http://www.untangle.com/Spam-Blocker

OMG

[hesaigo999ca]

How many more times can i explain this, the ONLY foolproof model, is to charge per email sent, even if it is .01 of a cent, this will force not only the bad guys to spend money, and leave a paper trail for those using their own servers..which will then tend to up the bids and make alot less sense to use spam to send advertising per capital.

This would also be a quick sure way to let someone know they have been compromised, they could have
a first offense 100$ cap for emails sent from their PCs, then 500$ cap for second offense (for those that are too cheap to fix their virus ridden computers) and then 3rd strike full price.

This would also allow ISPs to track see who sends millions of email from their home PCs,
as a home profit scam. This send an email..pay to send it...system, can and will be
a great way to generate even more money, because who will reinstall windows for those people who have been badly overrun with malware, bestbuy computer guy that's who....

Re:OMG

[david_thornley]

Let's get this straight - who gets charged?

If it's a bot sending the mail, do we charge the owner of the pwned computer (who won't really notice), or the owner of the botnet?

Do we charge based on sending address, in which case anybody can be bankrupted with a sufficiently large Joe job?

Some variation on this plan might have worked ten years ago. It's hopelessly obsolete now.

Re:OMG

[mokus000]

On the upside of this particular solution though, it'd get harder and harder as time goes on for spammers to find customers that won't want to break their legs because of past experiences getting billed for their compromised systems' spam. ;)

Re:OMG

[hesaigo999ca]

Like i stated ...it would be up to the ISP to cap a particular "residential" line with 100$ for the first infraction...yes the person sending the email gets charged...so someone having virus that spams, would know this on their next bill...and could ask to reverse the charges, but then if they are caught again (because they did not remove the bug) , they are now fined 500$ and have may not as easily get this charge removed...also...a repair man to reinstall windows...might make things look harder , then it really is.... ghost your drive right after you install windows.... then if you get problems, you copy over the old image and start fresh...most use vmware with this...

There are so many ways of doing things these days, people need to get current and up to date not only with updates, but also with ways of getting around problems of spam.

Letters of Marque

[dazedNconfuzed]

Yeah there's a solution, it's cheap, and it's even explicitly in the Constitution: get Congress to issue Letters of Marque.
I'm sure there are plenty of people who would take care of the problem for free, if only they got suitable permission.

Re:Letters of Marque

[Anonymous Coward]

Yeah there's a solution, it's cheap, and it's even explicitly in the Constitution: get Congress to issue Letters of Marque.
I'm sure there are plenty of people who would take care of the problem for free, if only they got suitable permission.

Shutupshutupshutup!

You're giving *AAs ideas!

Next you'll be hearing wailing along the lines of "Arr! Shiver me timbers, thar's a privateer on our stern!"

Dunno if it's been said, yet, but...

[Khyber]

Simply make an e-mail whitelist for that network. It's not that hard. Deny all external emails except for external authorized users (IE They're logged into the network thru a VPN or something) and basically deny any email outside of defined IP addresses. That should cut about 90% of your problem.

Wanna kill the other 10%? Get your network offline and keep it to internal usage only.

Massive spam or massive solution...?

[macraig]

I'm confused!

Server side or DNS signatures

[tacarat]

Of all the organizations on the planet, the military should be the first to do something like this. All "real" emails from their servers should get a digital signature that their other servers will use for validations. If a .mil email doesn't have it, then it needs to be dropped immediately.

It certainly won't stop every spam, but it's a good first layer of protection. It will should help with spoofed military email addresses that get harvested. I personally think the emails should be fully encrypted before leaving the servers, but that's more for proper security, not just validation purposes.

Partner with Google

[ironicsky]

As evil as it sounds for a big evil organization to partner with another, Google's spam filtering technology on gmail is pretty damn impressive,. I get about 2000 spam messages in 30 days on one of my multiple gmail accounts. I rarely have a false positive or false negative. I'm sure Google's mail filter is just an over glorified Bayesian filter, but with over 100 Million users contributing to the "This message is spam" list to help build the filter you couldn't go wrong. Hell, if Google gave me the option of running all my personal mail servers messages through their spam filter before it hits my mailbox I'd pay for it.

Re:Partner with Google

[fishbowl]

>Hell, if Google gave me the option of running all my personal mail servers messages through their spam filter before it hits my mailbox I'd pay for it.

They do, sort of. We did something similar, before we fully migrated to gmail (our domain, not gmail.com). We had a local mail server that would transfer via imap after messages were delivered to gmail, until all users were migrated and we shutdown our local mail server.

Echelon

[DarthVain]

Change the word table from:

"Bomb", "Terrorist", etc...

to

"Penis", "Pen1s", etc...

then

Give Chuck Norris a call.

It's not rocket science

[Anonymous Coward]

The spammers get paid well from the companies that they spam for. Why not fine the companies that the spam advertises for? Spamming is not an easy thing to do with a high enough success rate to actually get money for. Hell at *least* they'll stop the spammers from spamming the government.

Good idea.

[Anonymous Coward]

Too bad these haven't been used since WWII

We need a whitelist that doesn't suck

[steveha]

The only solution is to make a system that uses a whitelist. But whitelists suck. So we need a whitelist that doesn't suck.

The first step is to have all the email clients start digitally signing emails. It is trivially easy to forge the headers on an email, so it would be stupid to trust them for identity information.

The second step is to have email servers check the identity against the whitelist. If the digital signature is invalid, or the credentials are forged (message was digitally signed, but the announced public key of the sender doesn't match) the message is trashed, with no error message sent. If the signature checks out, but the sender was not on the whitelist, the message bounces back to the sender, with an explanation ("you weren't on the whitelist, sorry").

Okay, but whitelists suck. If my best friend from college wants to track me down and send me an email, I want him to be able to do that; but I don't know his email so he's not on my whitelist. So, we need a solution to this problem.

My proposed solution is that your email server should advertise a list of ways that you will accept to bypass your whitelist for a message. One possible way: attach a micropayment of five cents. Another way: attach a certificate showing that your computer worked for an hour on some worthy problem like protein folding at home or something. Another way: here's a URL of a web page; it contains some riddle... attach the answer to your email. I'm sure you can think of other schemes to make it possible for a friend to bypass your whitelist while not enabling zombie Windows clusters to spray spam into your inbox.

There are other refinements possible. Your whitelist can accept, not just individual signatures, but "badges" from some organization. So, anyone from Mozilla.org can attach a Mozilla.org badge to their emails, and I can allow all Mozilla.org emails through. IEEE member badge, SourceForge.net badge, Apple.com badge, go nuts. Even an organization of "I Swear I Will Never Send Out Spam". The key with the badges is that, if you get kicked out of an organization, you have to lose access to the badge. One simple way would be for the check to be live: if you attach a Mozilla.org badge, the Mozilla.org server had better agree that your identity is one known to it.

The current email system is a "Default Permit" system (the #1 dumbest idea on this list). It has to change.

This system would run on the infrastructure we already have, with a few additions. You could have one account with the whitelist, and another account without... but the one with the whitelist is the only one that pages you, or whatever. The important thing is that this doesn't require everyone in the whole world to adopt it before it starts to become useful. Mailing lists would still work, because when you sign up for a mailing list you would add that mailing list identity to your whitelist (probably a badge, such that members of the mailing list are then cleared to email you directly, through the badge).

Someone may claim that validating public key signatures is computationally expensive. No, not compared to running complicated heuristics over the content of a message, trying to guess whether it's spam or not (SpamAssassin and other systems). With this system, the server doesn't attempt to classify a message. Either it passes the whitelist, it's bounced back to the sender, or it's deleted. Done.

Now, if you have found a hole in this idea, you will score bonus points by explaining how to fix it, not merely pointing out that I am an idiot.

steveha

Re:We need a whitelist that doesn't suck

[kindbud]

I'm sure you can think of other schemes to make it possible for a friend to bypass your whitelist while not enabling zombie Windows clusters to spray spam into your inbox.

Yes, I can. It's called reputation filtering, and it works extremely well. You have to pay for it, though.

Re:We need a whitelist that doesn't suck

[AnyoneEB]

There are other refinements possible. Your whitelist can accept, not just individual signatures, but "badges" from some organization. So, anyone from Mozilla.org can attach a Mozilla.org badge to their emails, and I can allow all Mozilla.org emails through. IEEE member badge, SourceForge.net badge, Apple.com badge, go nuts. Even an organization of "I Swear I Will Never Send Out Spam". The key with the badges is that, if you get kicked out of an organization, you have to lose access to the badge. One simple way would be for the check to be live: if you attach a Mozilla.org badge, the Mozilla.org server had better agree that your identity is one known to it.

Congratulations, you just invented Facebook messages.

Seriously, I like the idea of signed e-mails, web of trust, etc., but I cannot see it being feasible for the common user. And anyway, why would they bother? Facebook allows them to set which groups may message them and handles spammers. I do not like it much -- and explicitly ask people to use e-mail if they try to contact me via Facebook message -- but there are significant social and technical barriers to what you are suggesting.

Furthermore, I am not sure how much signing e-mails would actually help if spam is already sent by botnets via random people's computers: the botnet could easily just collect a bunch of keys and contact lists (so it would know who would accept e-mails signed with that key). It would at least let you know whose computer was compromised which would (possibly) add some clear personal responsibility to keeping one's computer clean of malware.

Re:We need a whitelist that doesn't suck

[steveha]

Congratulations, you just invented Facebook messages.

No. I am proposing basically the same system we already have, not a walled garden controlled by a single company who can unilaterally decide to censor your email traffic.

I cannot see it being feasible for the common user. And anyway, why would they bother?

I see it being totally feasible for everyone. The email client should have certain features, such as auto-adding people to your whitelist when you email them; that way, if two people send each other an email, they have already done all the work needed to make sure they can send each other email anytime. It would even be possible to put whitelist controls in an HTML "wrapper" around the actual email, and thus older email clients (such as Microsoft Outlook) that don't have the new whitelist features would still be usable with this, as long as the email server had the features.

As for why would they bother -- getting all their email, without any spam. I guess that is a benefit of Facebook messages as well, but this solution scales to the entire Internet. I could see the US military rolling out signed email and whitelists, and I can't see them switching to Facebook messages. (The US military has a great setup for whitelists; any email not sent from a US military server is probably not critical for most of their users. Private Jones in the Army motor pool isn't fixing cars for anyone outside the Army.)

there are significant social and technical barriers to what you are suggesting.

I think the technical problems are pretty easily solved. The social ones, we'll see. If we could get the vast majority of users on a system like this, where they never even see any spam, I dare to dream that spam may become unprofitable and the amount of spam in the Internet will drop below 95% of all email.

I am not sure how much signing e-mails would actually help if spam is already sent by botnets via random people's computers

Few of my friends are clueless enough to let their computers get 0wned without their knowledge. If one runs afoul of a worm and doesn't realize it right away, our clue will be when I start getting spam with my friend's identity on it; we will instantly know that his computer is 0wned, and if my friend doesn't instantly fix the problem, I can immediately block his email address from my whitelist (say, for 15 days, so I don't have to remember to turn it back on).

the botnet could easily just collect a bunch of keys and contact lists (so it would know who would accept e-mails signed with that key).

This level of effort is unlikely for the spammers. The reason spam works is economy of scale; they need to send out hundreds of thousands of emails at a time in order to find a few people gullible enough to believe that a product sold by spam might be worth buying.

Even if the spammers write really clever worms that work as you describe, this is still not as good for them as the current situation, where an 0wned computer can spray spam to any address on the Internet, tens of thousands of messages at a time.

steveha

Contact Messaging Architects.

[Anonymous Coward]

I'd recommend that they contact Messaging Architects. I think that they'll find that they have a solution that can be scaled to handle that amount of traffic.

Surge or "Operation Flytrap" Respond 2 spam x5

[retroworks]

Surge the spammers. It must take them some time to enter credit card information from the gullible people who actually respond to the spam. NATO should capitalize on that, and employ the armed forces to answer every spam solicitation with a "flytrap" credit card number. The spammers would see their responses spike but would be tied up wasting their time on non-productive responses. If the NATO guys from Germany are just sitting around in Afghanistan playing on their laptops and drinking beer, they could be multitasking and responding to spam with fake credit card numbers.

i propose that...

[krystar]

it be a massive computer program seeded into the internet with no central core. its purpose to seek out assigned targets and deal with them. and we'll put AI algorithms into it. and call it skynet

I thought the already had a solution!

[Anonymous Coward]

Operation Unsubscribe

Uh, we scan about 50 million messages a week.

[jonpublic]

9 servers. 50 million messages a week. Those 9 servers cost maybe $3,000 each. We have 9 servers because we want some redundancy. So let say you multiply that by 7. So you get ~50 machines to handle the army's volume. $150,000. Plus all the extras, so multiply that by 6. That's about a million dollars.

Seriously? From the article they say it would cost $100 million. Do you really think that is going to cost $100 million dollars? Seriously?

WTF. I need to become a DoD contractor.

Re:Uh, we scan about 50 million messages a week.

[cenc]

You for got to then times that by 100 that is required for the DOD to write any check. The extra zeros are simply printed on the checks to save time.

Re:Uh, we scan about 50 million messages a week.

[Daniel_Staal]

Ok, now you can't just stand up 50 machines to handle email. They have to be coordinated (and load-balanced).

Plus you have to have test and dev boxes. (Because you aren't doing that on live boxes, right?)

So, lets add a few high-end ethernet switches in. And don't forget things like DNS boxes (to cache, so you have decent performance for all the DNS lookups most spam systems do these days), and a few really high-end firewalls. Oh, and racks to mount these all in, plus cabling. And a power supply. (Not the ones in the boxes, the one outside the building converting the mains power to 110. You'll need at least one extra.) Oh, which reminds me: Better have a backup generator. And a failover UPS for the whole place.

Heck, you may need a new building to put all this in. Which will need an HVAC system, of course.

Oh, and those machines won't run themselves. So you'll need to hire a few people; fairly qualified admins.

Which mean they need desks, computers, monitors, chairs, phones, pagers, possibly laptops.

And it's a decent-sized team, so remember to fund their manager, and possibly an HR person for them too.

We haven't mentioned the actual data line yet. It's going to have to be a big one, probably installed especially for this. Oh, and you'll want it redundant. So, make that two. (And better remember how much it is going to cost just to negotiate for those lines: That's several man-months of time, most likely.)

Of course, we haven't talked software yet: Likely you'll want Unix/Linux, but for this you'll probably want an official support contract. Which covers the OS. We'll also want one on whatever anti-spam package we are using. And possibly one on a monitoring package, to help keep track of when it is up. There may be others as well.

Oh, and for full redundancy, you'll probably want to set up at least two separate sites. So, double most of the above. (We'll use the same admins for both.)

Hmm. Haven't talked backups yet. That's probably going off-site. A few more computers, a tape machine, off-site transport, admins to run all of it...

So, um, how long is that $100 million supposed to last for anyway?

Re:Uh, we scan about 50 million messages a week.

[rcw-home]

Heck, you may need a new building to put all this in. Which will need an HVAC system, of course.

Oh, and those machines won't run themselves. So you'll need to hire a few people; fairly qualified admins.

That's right, these would be new expenses, because it's all new functionality - as we know, the US military does not currently use email. And there's no possible way they would have a datacenter already.

Re:Uh, we scan about 50 million messages a week.

[Daniel_Staal]

Maybe, maybe not: It is a new project after all. Sure, there may be resources that can be used from other projects, but it's also possible that this is in addition to the other projects, and therefore is a new cost.

Regardless, the ongoing costs will be billed to this new project, and so would have to be included in the total.

Re:Uh, we scan about 50 million messages a week.

[dodobh]

The OP already included redundancy. Spam filtering redundancy is mostly a bunch of identical servers in different locations with MX records to handle load distribution and load balancing.

The hard bit about spam filtering is your ruleset(s) and spam pattern matching checks (which are difficult to write correctly and need expensive humans to be involved).

Kill The Spammers

[Nom du Keyboard]

Unless you use your new system to hunt down and kill the spammers, you will never win. You will only spend an ever increasing amount of money fighting a losing holding action.

Re:Kill The Spammers

[Anonymous Coward]

we need a good old fashioned t1000

Re:Ten dollar tent-Reconsider

[Nom du Keyboard]

I hope they don't shoot $10M cruiser missile to take out $10 tent housing Packard Bell botnet control center.

If it actually is the botnet control center then it's probably worth taking out. And maybe you'll get the operator with it!

Technologically easy (socially impossible)

[Anonymous Coward]

Wanna talk to someone at DoD? You have to sign your email. Not signed? Automatic bitbucket. Signed? Look the keyid up in the spammer-versus-not-spammer database. Not in the database? Greylist the fuck out of it and make sure that whatever human ends up looking at it, has an easy way to mark it as spam/notspam.

They want to scan outbounds? Stupid, stupid, stupid. You are preventing people from encrypting. (Yes, I know we're talking about the unclassified network. Doesn't matter; an email to your sweetie saying what time you'll be home, is worthy of encryption.)

Re:Technologically easy (socially impossible)

[patches]

They want to scan outbounds? Stupid, stupid, stupid. You are preventing people from encrypting. (Yes, I know we're talking about the unclassified network. Doesn't matter; an email to your sweetie saying what time you'll be home, is worthy of encryption.)

Considering we are talking about DoD users here, and DoD users include soldiers. Emailing your sweetie to tell what time you will be home is in violation of OPSEC, and should be blocked from going out of the mail server in the first place.

Nope, try again.

[professorguy]

Let's say we each run ISPs. You send me spam. I charge you. You charge the spammer. The spammer doesn't pay. You cut off the spammer.

Then I cut off you. After all, you didn't pay. Now no one on my network can email anyone on yours.

Back to the old drawing board.

Re:Nope, try again.

[Hotawa Hawk-eye]

Another idea: when anyone signs up for an account with an ISP, they put a small amount of money (let's say $10 just for sake of argument) in escrow. If their accounts are terminated because they violated their contract with the ISP, the escrow is forfeit to the ISP. If they terminate their account normally, the escrow is returned to them.

Now for most people, putting up $10 once when they sign up for internet service isn't a problem and they're going to get that back when they stop using that ISP. But this hurts spammers that are likely to have their service terminated, because they're going to have to sign up for multiple accounts and pay (and lose) the escrow fee for each one. People now have an extra financial stake in keeping their computers secure (since they'll lose their escrow if their service gets terminated when their machine is compromised and used to spam) and ISPs could use forfeited escrow money to pay a workers to scan through logs looking for spammers.

Re:Nope, try again.

[Baricom]

Wouldn't the spammer just pay the $10 using the same stolen credit card they're using to pay the monthly fee?

For *once*, "world police" sounds good to everyone

[Hurricane78]

Seriously. You have troops, agents and all. Just shoot them. And if they are in another country, and that country refuses to extradite them, invade 'em. It's what you do best, and for once, everybody on the whole world could agree. Even North Korea and the Taliban. ^^

Re:OMG-Second This

[Nom du Keyboard]

How many more times can i explain this, the ONLY foolproof model, is to charge per email sent, even if it is .01 of a cent,

I'll second you on this. As much as I love Free - and Free really is and always has been one of my most favorite things - an economic solution to this is by far the best approach to this. Give the money to the person receiving the e-mail - e.g. you pay me to receive your message - and I can use that as credit against e-mails I send myself. Then I might even accept that crap - before deleting it.

SPAM solution = more BOFH

[Anonymous Coward]

The answer to stopping spam is to simply stop making excuses for badly set up and administered legitimate mail systems. If standards are set up and enforced for simple things like reverse-lookup or SPF records most spam would be easily identified amongst the ham. If your business partners REALLY want to do business with you then they'll set up their mail servers and DNS correctly. When companies start losing money because they can't get their mail delivered, maybe they would start to care. We need more Bastard Operators out there to clean things up.

AIM-54C

[jra]

Phoenix means you never had to say you're sorry.

Hold telecoms accountable

[Anonymous Coward]

How about we hold the telecoms accountable for allowing these people to use their networks to send unsolicited e-mails?

We are always playing cat and mouse with spam filters etc but never get ahead of the criminals. Telecoms know or should know the traffic patterns of who is sending and receiving. Hold them accountable for shutting down IP's, servers in their data centers etc. Cut it at the source.

You seriously think they're just asking about spam

[desinc]

Immediately I thought this was just a clever front for the military's plans to monitor ALL email.

It's simple, really....

[Hasai]

....You hunt them down and kick their asses.

Cops and prisons exist for a set of very real reasons. Applying technical 'fixes' to what is a criminal enterprise is like busting your ass building ever higher and ever thicker walls around your house: If you don't deal with the root of the problem, the criminals themselves, all you're doing is delaying the inevitable.

Everybody up to this point has been engrossed in spending all this time and money building ever higher and ever futile walls, ceding the world of the Internet to the criminals while we try to make our tiny little pieces of turf 'safe.'

Personally, I think it's time we took the Internet back.

'Nuff said.

Re:It's simple, really....

[Anonymous Coward]

Personally, I think it's time we took the Internet back.

AMEN !!

WoT the whitelist

[Sloppy]

If my best friend from college wants to track me down and send me an email, I want him to be able to do that; but I don't know his email so he's not on my whitelist. So, we need a solution to this problem.

Publish/share whitelists. You haven't whitelisted your friend, but somebody has. Find 3 people who say "this guy is not a spammer," who themselves (recursion alert!) are not spammers.

In other words, guess their spammer rep the same way you guess whether or not to use an OpenPGP key that you haven't personally certified.

Re:WoT the whitelist

[Anonymous Coward]

I take it that "WoT" is short for "Web of Trust"?

Re:WoT the whitelist

[AnyoneEB]

My issue with WoT for e-mail is that if botnets are sending the e-mail already, then the spammers have easy access to at least thousands of computers: getting access to "known good" signing keys of the web of trust would trivial. If the spammer gets reported then the signer becomes suspect. Essentially, to the common user this looks like their signing key randomly breaks. Depending on the system design, some recipients may decide they are a spammer and drop their e-mails without notice.

As long as malware and botnets are ubiquitous, a trustworthy widespread web of trust seems unlikely. On the other hand, without botnets, spam would likely not be a major issue (although there are plenty of reasons why a web of trust is a nice thing to have around anyway, mainly that it would allow most e-mail to be encrypted).

Re:WoT the whitelist

[Sloppy]

if botnets are sending the e-mail already, then the spammers have easy access to at least thousands of computers: getting access to "known good" signing keys of the web of trust would trivial. If the spammer gets reported then the signer becomes suspect. Essentially, to the common user this looks like their signing key randomly breaks

I don't think there can ever be any solution that doesn't involve people-who-join-botnets not getting blocked (either by dropping off whitelists or getting blacklisted). If your computer sends spam, then you are indistinguishable from a spammer.

People are going to have to bear some consequences for being part of a botnet. I know lots of people hate that idea because Joe Sixpack doesn't really consciously decide, "Hey, I think I'll join a botnet and send spam," but he makes decisions that, from the outside, look just like he did that, and have negative consequences for other people. A drunk driver doesn't mean to kill anyone, but people die regardless of the driver's motives, and improving behavior makes the deaths not happen. A botnet node owner doesn't mean to send spam, but his computer is still sending spam, and improving behavior makes the spam not happen.

Some people say that Joe Sixpack's behavior won't improve, and that this is not a reasonable expectation. Users can't be educated? Fine, I won't debate that. I can think of two ways to deal with that. 1: get Joe some better tools so that opting into a botnet isn't just a simple mouseclick away, and

Essentially, to the common user this looks like their signing key randomly breaks. Depending on the system design, some recipients may decide they are a spammer and drop their e-mails without notice.

2: Let that happen. It's an acceptable outcome. I don't have a right to demand Joe learn to not spam, but he doesn't have a right to demand anyone read his email, either. If he doesn't like it, he can get educated. If he can't (or doesn't want to) learn to stop sending spam, ok, fine. We stop getting his spam and he is freed from having to learn. Everyone wins. Joe thinks he lost (since people who don't want spam are now throwing all his email into the bitbucket) but he received something in exchange for that: he's free some having to act like a responsible person. He doesn't have to be part of society, if he doesn't want to.

It sounds insensitive and nasty, but what else can we do? If blocking botnet node owners isn't tolerable, then we're just going to have to tolerate spam.

centralize!

[bugi]

Oh yeah, centralize that. Good idea. Then only one system needs to be compromised -- I mean only one system needs to be defended.

Hmm, didn't somebody here mention people with guns?

I Propose very large pieces of bread

[gemada]

and just make a giant spam sandwich and eat it

Re:For *once*, "world police" sounds good to every

[Anonymous Coward]

Fuck, yeah!

simple solution

[DragonTHC]

bomb the spammers.

Yeah, "spam."

[mdm-adph]

I'm sure that's what they want to scan all of our emails for. Certainly.

This has potential

[Animats]

This could be useful. It will result in an official DoD list of known spammers. That will make prosecutions easier. And the "attack on Government computer" provision in the Computer Crime Act will apply.

If someone from DISA pushes hard enough, the FBI can be tasked to take down the top spammers. It doesn't matter where they are; if the U.S. Government is annoyed enough with them, they can be shut down. That's what the State Department is for.

If one spammer a month went to jail, there would be a huge drop in spam. We see a big drop each time a big spammer goes down. There just aren't that many players.

Re:This has potential

[geekoid]

Spammer have gone to jail. note the lack of less spam.

Re:This has potential

[Anonymous Coward]

It's not going to come from DISA. They are just a service provider... they have little more authority over DoD "networks" than Comcast does over your home network. Just because they are DoD doesn't mean they actually defend anything (or know how to do it). They claim they are at the "tip of the spear" "supporting the warfighter" but all they do is provision comms for the military services (and other DoD agencies). They are, at their core, an acquisition bureaucracy.

9mm?

[Anonymous Coward]

Only 200? I buy 50 round boxes of 9mm for about $12/box. Spam is a problem that could be solved for $50.

Actually it would cost more. Remember: two in the chest, one in the head.

And we better go with .45 ACP, preferably hollow point, just to make sure.

And silver instead of lead if you're really paranoid.

DOD has great solutions

[krakround]

Predator UAVs with Hellfire missiles. Fabulous antispam solution. Ask Abu Musab al-Zarqawi. SEAL snipers have recently proved themselves to be an amazing solution as well, providing antispam protection ship-to-ship at night.

Time to charge 1 cent to send a message

[BrentRJones]

and 1 cent to read it. Money goes to retire the national debt.

Also shouldn't we email users every 30 days (at random) REPLY to a spam message with misinformation. Slashdot em to hell.

Miltary Spam Solution

[Tired and Emotional]

Oh great, now I am going to start getting recruitment ads in my in box!

Join the Army! Travel the World! Meet lots of interesting people, and kill them. (Spike Milligan; The Greate McGonigal, the Truth at Last)

Services will do this better

[Anonymous Coward]

"Army Lt. Gen. Keith B. Alexander, director of the National Security Agency, told an audience attending the RSA Security Conference in San Francisco in April that about 20 billion e-mails are sent globally every day, of which 65 percent to 70 percent are spam."

That's a terribly low estimate. Postini processes upwards of 3bn emails per day, of which over 95% is spam. And that's a tiny, tiny portion of global email traffic.

Blanket spam solutions are an ongoing battle with ever-evolving methods - not a "we'll buy this thing for $100m and then it will Just Work." There are filtering and archiving services that spend their energy battling spammers every day. I don't understand why the DoD would want to pay for someone to create and maintain a custom infrastructure, much less take on the responsibility of reacting to new spam methods for a single customer that generates only 50m emails per day.

Moreso, the effectiveness of a spam filtering solution is dependent on the richness of the IP blocklists it maintains plus the header, attachment, and spam content definitions. Why start from scratch when there are rich data sets that these services have been building for years?

Postini does this well.
Exchange Hosted Filtering does this well.
The DoD or whoever it hires will never do this well.

This is one area of IT best left to the pros or client-side filters customized to the specific end-user.

Bargain with a service for a few dollars a year per end-user and it'll be 7 years before you approach that $100m price tag, which I'm sure doesn't include servicing the equipment or adding new features.

What a complete waste of taxpayer's money.

I will say it again

[IamGarageGuy 2]

The only real solution to spam is to get to the source of the income. The way to stop spam is to have the credit card companies hunt them down and stop the payments. The way in which spammers are paid is through credit cards, so if they cannot use credit cards the business plan fails. Unfortunately the credit card companies also get income from spam.

Sperm

[Anonymous Coward]

Anyone else read this from across the room as "US Military Looks for Massive Sperm Solution"?

For a second I thought there may have been a good reason I haven't looked at any porn since Monday...

The Final Spam Solution.....

[IHC Navistar]

EXECUTE THE SPAMMERS.

If some idiot thinks that they actually deserve to be treated by people, you can:

1. Take ALL their computers away from them. Wipe their drives and donate them to needy schools.
2. Seize ALL their financial assets, such as stocks, bonds, home equity, savings, checking accounts, and cash.
3. Seize their personal assets, such as jewelry, cars, real estate, boats, electronics, furniture, livestock, and house, and donate to needy schools/community colleges.

Let them suffer complete forfeiture of their assets. That is the only way these idiots will learn. Alan Ralsky, for example, keeps setting up new enterprises regardless of his punishments.

For those that have a family with small children that need to be taken care of or a disabled family member that depends on them, liquidate assets so that the children or disabled family member won't suffer the life-changing interruption because of one of their parents. If it is both parents, then send them to live with a foster parent, and use the proceeds from the liquidation to support the foster family as well as the children, or a specialized care facility if they are disabled. Also, forbid contact with the offending parties until the minor reaches age 18, and put in a stipulation that the offender can NEVER benefit from the proceeds through another party.

Vulnerable due to decentralization?

[kindbud]

DISA's request ties in with recommendations that the Defense Science Board issued in April that said Defense is more vulnerable to cyberattacks because of its decentralized networks and systems.

What the fuck, over? I seem to recall this same Department designed the internet some 30 years ago so that decentralization was a core feature in order to improve its resiliance to cyberattack. </facepalm>

If anyone from DISA IT is reading

[Anonymous Coward]

Other agencies have figured this out (check out DHS for multiple domains). Pick up a phone and call around. No need to re-re-re-reinvent the wheel. Seriously.

Editing error FTW!

[rts008]

Well, if they're looking for a 'Massive Spam' solution, then instruct all DoD users to 'opt out' of all spam, open the networks to the bot-herders, and disabling firewalls and proxies. I'm sure I've missed a few things here, but this will provide a good start on getting 'Massive Spam'.

Oh, wait, are they talking about 55 gallon barrels, or hogsheads of Spam(tm)? No, it must be about shipping containers of Spam(tm), that's it!
No?
Now I'm confused!

ScuttleMonkey must be KDawson's understudy/minion. Aren't 'editors' supposed to edit any more?

Now I will have nightmares of a 'Massive Spam(tm)' the size of the planet Jupiter crashing into Earth, and killing all of the dinosaurs!...Again! Gee thanks, ScuttleMonkey!
P.S. Have a HAZMAT crew on hand before you open my next x-mas card, 'editor'! (hint: if it's flaming/smoking don't stomp on it to put the fire out! Heh! Heh!-)

Seems pretty simple...

[Eric Damron]

The military has lethal weapons and spammers are mortal... Need I say more?

reuse socnets for spam filtering?

[Anonymous Coward]

just a thought: why not reuse those omnipresent social networks? a kind of layer in e-mail communications. Inbound mail would be ranked by degree of connectedness to the adressee. And senders who are connected to several people of the next more inner degree would get a rank in between, say depending on to how many of these circle the sender is connected.

would kill out spam but keep friends etc able to get read

Ah, the military! They can shut them down.

[CrazyJim1]

The United States law systems cannot shut spammers down because spammer scammers are frequently out of the country. The defense department could track down offenders and knock down their door. Of course, the enemy nation may not take kindly to this.

Report it and help facilitate action on reports

[Khopesh]

If a major player, usually seen as a freemail provider like google or yahoo, but certainly also any large corporation or government agency, were to simply start reporting their spam, the problem would go away.

Beef up and aid services like KnujOn and SpamCop and remove the ease of sending spam and (more importantly) the profitability. But that only goes so far -- it nails the pseudo-legit spammers, but it only slightly hampers the straight-up criminal ones (while eliminating their competition).

The next step is escalation; like Blue Security, create a do-not-email list (using hashed emails for privacy) and then after a lack of response from SpamCop's reports, utilize the opt-out requirement of the CAN-SPAM law to essentially flood the spammer with unsubscribe requests. I've detailed this proposal, along with how to decentralize it to make it immune to the DDoS that stopped Blue Software, on my website at http://khopesh.com/wiki/Ending_spam

There are good COTs out there

[lderezinski]

IronPorts (and no I don't have anything to do with the company) But who am I kidding ... This is DISA they will have to roll their own to the tune of 100 Billion dollars ...

Roundabout way to snoop on everyone's email

[Anonymous Coward]

When you secretly scan emails off the major backbones in the name of security, it's "wrong", so what you do is do it under the auspices of a beneficial service and reason (spam) and end up still the snooping ability the government wanted in the first place.

get rid of your centralized targets

[Anonymous Coward]

The military treats it's users like a corporation does....they are cloistered behind firewalls and forced to use managed software under MS windows and a preconfigured, managed set of applications.

So of course they are easy to locate, target and break.

Since it's an unclassified network fire all the IT depts. and give everyone local internet accounts, just like the people have at home.

Over the last couple years the mil it depts. have turned high end quad-core multi-gig machines into virus-detection and scanning POS's that take 15 minutes to boot.

They've also blocked a massive amount of useful sites and software and slowed down work, and broken many s/w packages.

Many users I know are tethering notebooks to their mobile devices to get their unclass work done during the day. That's a dead giveaway that the DoD is dysfunctional and in complete denial of how bad they've fucked up their IT with all the network nazisms.

Here's a clue DoD--get out of the way and use COTS and freedom.

Transition the NIPRnet accounts to AT&T and Verizon or whatever the local broadband solution is and just go find something else to do, rather than break 1000's of machines, degrading them ever further, in random ways, every so many weeks.

The BESTEST Solution

[fibrewire]

* Reprogram the massive botnet used for spamming into components of a massive AI system

* Launch "Skynet" to combat the growing problems of spam and malware

* Find your friends, go to the local pub, have a beer, and wait for the whole thing to blow over ;)