2 nd International Summer School Risks and Challenges of the Network Society Karlstad University and HumanIT Theme: Service Provider Responsibility for Unsolicited Commercial Communication (Spam) by Mr. Evangelos Moustakas and Dr Penny Duquenoy Middlesex University School of Computing Science London, UK.

Structure Topic - Aims and objectives Using Advantages /Disadvantages Problems caused by Spam Spam Stakeholders Technical Approaches to Blocking Summary and Conclusions Questions - Discussion

–Benefits-Advantages >Share data more easily and efficiently >Efficient method of soliciting customers and selling products. >millions of families and home users. –Disadvantages >Unsolicited Commercial ‘Spam’, >Impinges on the privacy of individual Internet users >Time Consuming reading and deleting the messages where users pay time-based connection fees. >Spam is a violation of Internet etiquette.

Users spend €10 billion/year in connection costs just to receive "junk" s (Research undertaken for the EC)

Problems caused by Spam Customers: Spend on-line time downloading & reading spam ISPs:Cost of providing the infrastructure Frustrates their customers Support overheads - complaints from customers Several systems have collapsed Enterprises: Lost productivity E-Commerce: Threat to consumer confidence in e-commerce Computer viruses arrive via spam ‘I love you’ virus

Stakeholders Internet Service Providers (ISPs) Government – Legislation Customers – Individuals Corporations – Enterprises Marketing Associations Spammers

ISPs E-Commerce (EC Directive) Regulations 2002 Cases where ISPs do accept liability: > Contractual liability > Unauthorised form of messaging > Liability after notice > Liability deriving from Article 7 Data Protection Act > Non-Effective ISP Anti-Spam Techniques that raise liability.

Government - Legislation European Union, EU Directive 2002/58 Effectiveness of the Directive > Most spam originates from outside the EU. > Awareness of the larger companies >Reduction of market competition >Reduction in consumer choice. >Reduction of the impetus for business to develop effective software solutions >The Directive does not prescribe how to meet the requirements Canadian Code of Practice for Consumer Protection in E-Commerce 2003 USA Act of 2000 for UCE Mail

Customers – Individuals > Should be aware that ISPs offer a choice of services > Customers are the ones that will form the ISP’s services. > This will force ISPs to develop anti-spamming software applications > Caution when choosing browsers and other navigation tools > Caution when completing a transaction > Newsgroups - open discussion areas are frequently used to collect s

Corporations – Enterprises > Double role > Development of an e-Policy Guidelines about subscribing to newsletters and web-sites Specify how employees handle unsolicited Should detail how employees can use for personal use. > Employees must be properly educated.

Marketing Associations Control their members’ behaviour online. Ineffective - spammers are not members of the organisation Canadian Marketing Association (CMA) Consumers must be given the opportunity of "opting-out" of any further communication A marketer who fails to live up to the CMA code is expelled from the Association. Direct Marketing Association (DMA) Has launched an Preference Service with a special Web site (

Current Technical Approaches to Blocking Real-Time Blocking Lists MAPS Realtime Blackhole List (RBL)Lists of known spammers Best solution for ‘Dark spam’ e.g. known pornographic spammers BUT Not to ban the entire domain The originating address of a message can be spoofed

Current Technical Approaches to Blocking Content Filtering Technologies >Who can decide what words are offensive? Elron and Oxford English Dictionary (OED) >The problem of “false/positive” hits >Whether confidential information is read from unauthorised parties during the filtering process >“Bouncing back” suspect s >“Honeypot” approach

Summary and Conclusions Problems created by spam Legislative measures currently in operation - Weaknesses. The effectiveness of the EU Directive is small Technical measures (software applications) Cases where ISPs incorrectly blocked legitimate personal communication Co-operative approach is needed, utilised by Internet Service Providers as the primary gatekeepers between senders and recipients.

Thank you :) Evangelos Moustakas (B.A., MSc, MPhil) PhD Researcher Middlesex University