Subject: [Asrg] A Taxonomy of Spam

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 25 Jul 2006 09:20:37 -0700

OK so defining the term spam is off limits to the group because it ends up in definitional flame wars. A lot of folk were engaging in flame wars and there were folk whose definition of spam was 'that which is identified as spam by my scheme'.
 
Rather than have an extended communication here I suggest taking it to my blog so we don't annoy folk tired of the old discussion: http://dotfuturemanifesto.blogspot.com/2006/07/taxonomy-of-spam.html

But we now face a problem trying to explain schemes such as DKIM which are effective against specific types of spam but not others, or at least will require different degrees of infrastructure to eliminate different types of spam. We need a way to explain exactly what types of spam a solution will act on and what types of false positives will result.
 
I now think that abandoning the topic entirely because it was a flame fest was a mistake. The problem was not that we cannot define spam, the problem is that we were attempting a binary definition rather than providing a taxonomy. Once the term is understood to be a generic one with many subterms that might be defined within the class the problem becomes less contentious. We can define the term spam in the widest possible terms and then define more specific terms within that class.

So for example we might define spam to be any communication regardless of medium that is originated indiscriminately and likely to be unwanted by the recipient.
 
This definition eliminates very little, about the only form of unwanted communication that is excluded is things like writs, bills and such.
 
We can then subdivide spam according to two orthogonal axes: by communication medium: email, phone and by category, the two principal categories being criminal spam and non-criminal spam. Within each heading we have a series of possibly overlapping subclassifications.
 
Within criminal spam we have social engineering attempts (phishing), malware attacks (viruses, trojans, etc.), advance fee fraud, consumer fraud, theft of service, impersonation of origin.
 
Within non-criminal spam we have unsolicited commercial messages, chain letters.

Once we have a taxonomy it is much clearer that DKIM is designed in first instance to address the theft of service and impersonation of origin categories directly and may thus have a significant effect on criminal spam in general. DKIM is unlikely to have a great effect on unsolicited commercial messages unless and until there is an accreditation/reputation system to back it.
 
The purpose of CANSPAM also becomes clearer. While most spam that violates CANSPAM was already criminal before the act passed the act is still usefull because it serves as a tripwire offense enabling law enforcement to determine that a crime has occurred much sooner than without the law. CANSPAM does not change the legality of the spammers behavior but makes it easier to prosecute acts where the criminality is beneath the surface.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: John Levine <[email-masked]>
Date: 25 Jul 2006 22:38:16 -0000

>OK so defining the term spam is off limits to the group because it ends
>up in definitional flame wars. A lot of folk were engaging in flame wars
>and there were folk whose definition of spam was 'that which is
>identified as spam by my scheme'.

Taxonmies of spam are fine, and I agree they can be useful.  You just
have to stop when people start saying "no, you can't add that category
because it's not really spam yada yada".

R's,
John

---

From: Rodney Tillotson <[email-masked]>
Date: Wed, 26 Jul 2006 09:52:45 +0100

Phillip Hallam-Baker wrote:

 > ... The problem was not that we cannot define spam, the
 > problem is that we were attempting a binary definition
 > rather than providing a taxonomy ...

Definitions are going nowhere.
I would welcome a gazzetteer of things which constitute
"e-mail abuse"; but calling it a taxonomy and attempting to
structure classes of abuse just encourages drilling for
loopholes, particularly if its ulterior motive is to
explain DKIM to the masses.

The list would unfortunately have to include comments such
as:

"The practice of sending a message of wide distribution to
an address where it was not explicitly asked for, where that
message includes an undertaking to send no further messages
unless they are explicitly asked for, is an abuse of e-mail.
Note that the direct marketing industry disagrees with the
inclusion of this activity in this list [reference]."

"The practice of returning service notifications to the
apparent originator address of a message where it has not
been established that that address belongs to the real
originator is an abuse of e-mail.
Note that some e-mail operators believe the practice is
acceptable for some types of notification but not for
others."

You can't fix the mismatch of business and cultural models
or assumptions which (as later messages said) are at the
bottom of this mess; so documenting it is the natural thing
to try next. Who knows, putting all the information in one
place might start a chain reaction vigorous enough to
generate light as well as heat.

Rodney Tillotson, JANET-CERT
+44 1235 822 255