The Future of AntiSpam: A Blueprint for New Internet Abuse Tools

1
The Future of Anti-Spam A Blueprint for New
Internet Abuse Tools
MIT Spam Conference 2009

• Garth Bruen
• CEO, KnujOn.com LLC
• Gbruen_at_knujon.com
• http//www.knujon.com

2
Our Predicament

• Spam is still here
• Spam has increased
• Illicit profits have increased
• Criminals are organized and well-funded
• Anti-spammers are not

3
New Framework

• Rethink our objectives and strategy
• Develop a philosophy or set of principles for
  anti-spam
• Extend current tools in new directions

4
Anti-Spam Principles

• Spam is not an impossible problem to solve
• It is possible to collect and process every piece
  of unwanted email for examination and enforcement
  
• Spam is about who benefits from it, not who sent
  it
• Spammers send mass email because someone pays
  them to
• The motivation is money, the goal is a
  transaction
• Focus efforts on the transaction target or
  platform not on the advertisement
• Eliminating transaction access removes money from
  the illicit cycle

5
View of Internet transaction to a consumer

• The Pie on the Internet is often fake, never
  delivered, or substituted
• Internet transactions are a leap of faith
• That faith is being eroded

6
View of abuse reporting to a consumer

• End users do not know where to start when abused
• Headers, IP, ASN, etc. are foreign words
  ordinary users
• Expecting untrained, non-technical users to
  address the problem is a failed model from the
  start
• Adopt simple methods for handling unwanted
  traffic

7
Help Consumers Navigate Bureaucracy

• Build avenues to express grievances that generate
  trust
• Collect user abuse data on a massive scale

8
Data not Junk
9
Splitting Between URL Spam and Non-URL Spam

• URL Spam spam advertising domain names - has a
  clearly defined policy structure behind it ICANN
• Non-URL spam may be criminal and problematic but
  does not fall under ICANNs purview

10
Redefining the Scope

• 480 BC Greeks faced a Persian army that was one
  thousand times their size
• They forced the Persians to engage at a narrow
  pass Thermopylae
• Changing the size of the battlefield put the odds
  in the Greeks favor
• In essence they used math change a situation

11
Redefining the Scope
12
Redefining the Scope

• The Spam Balloon Like a balloon the spam
  universe is full of hot air
• The knot is tied at the provider level
• Fix or remove the bad providers to let the air out

13
Addressing The Current Policy Structure

• Dont write-off ICANN, industry, or government
• Work within existing structure to solve problems
• Test the current system to find bottlenecks
• Push system to limit and then enhance

14
Fixing Policy as well as Technology

• ICANNs main compliance engine was six years old,
  out of date and overloaded by KnujOns process
• Registrars contracted by ICANN had no obligation
  to disclose ownership or location
• Two factors converged to create a permissive
  environment

15
Fixing Policy as well as Technology

• WDPRS has been upgraded to handle bulk reports
• RAA now states Registrar shall provide on its
  website its accurate contact details including
  valid email and mailing address.
• Success here not just about technical tools

16
Focusing on criminal targets and using the law
when called for

• Not all spam leads to illegal activity, but much
  of it does
• Behavior illegal regardless of Internet usage
• Not all e-crooks in U.S., but their resources are

17
Aggressive Brand Protection

• Brand violations constitute huge portion of the
  spam problem
• Brand owners either do not want to engage the
  situation or do not know how
• Direct involvement from the brands can change the
  game

18
Daily Tally

• Total collected unique domain names
• Minus Dead Domains
• Minus Policy Violators
• Minus Clear Criminal Cases
• Minus Brand Violations
• ------------------------------------
• Remainder is examined, process is enhanced,
  remainder is placed back into process

19
Success Model for Non-URL Spam

• What happened to stock spam?
• SEC
• Accepted reports from the public
• Analyzed the emails and featured stocks
• Suspended trading of featured stocks
• Froze assets of those who profited
• Indicted perpetrators
• Problem has been minimized and managed

20
Conclusion

• Existing tools can address the problem
• A variety of efforts must be employed in concert
• Previously failed
• We can win
• Dont believe me?