Porn Spam

J

jasconius101

Guest
Some of my colleagues are getting porn Emails in work.
I reported it to the IT manager who said everyone gets it (not me) - though I suspect he may be downloading it himself. I was not satisfied with his reply and reported it to the MD who after a few days told me that everyone indeed can get it and besides if the IT manager were to regulate UTV spamfilter?, we would lose some of our normal Emails which may contain a word like 'asset' or such-like which could be 'misinterpreted' and filtered out.
Surely there is some way around this, and surely there is a law against this stuff? - after all, if it came through the post, you would call the Gardai in, whereas by Email it seems that we just have to put up with it.
 
though I suspect he may be downloading it himself
What makes you suspect this? It is difficult to see any link between his downloading activities and emails which your colleagues are getting.
surely there is a law against this stuff? after all, if it came through the post, you would call the Gardai in,
The internet is a global phenomonon. Do you really expect the Gardai to start investigation every porn mail that arrives in this country? If so, be prepared for a huge increase in taxes to pay for the ten-fold increase in the size of the force that would be required for this. Do you expect the Gardai to start chasing down internet service providers in far-flung islands of the Pacific ocean? There are some anti-spam laws in the US, with mixed results. However, these laws really just drive the activities offshore to less regulated countries.
besides if the IT manager were to regulate UTV spamfilter?, we would lose some of our normal Emails which may contain a word like 'asset' or such-like which could be 'misinterpreted' and filtered out.
Yes - you can get 'false positive' results with spam filters. The same applies to all security checks. The bouncer may turn away sober, nice customers from the nightclub, but that isn't an arguement to say that you don't need bouncers.

Spam filtering is a basic tool for any company today.
 
You're on very dodgy ground if you go around insinuating that material to which you or others object is the result of any individual's activities! Even if somebody was downloading certain material it does not follow that others in the organisation would necessarily get spam related to that material. Many people receive all sorts of spam without themselves or others on the same internet link having downloaded related material. There was a [broken link removed] style study done a while back (can't find the details right now) which involved setting up a new email address and not using it but simply waiting to see when the first spam/unsolicited email arrive and it duly did within seconds or minutes. People who are suffering from spam should look at installing desktop or server filters, email client rules and definitely avoid opening (including via a preview pane which should be switched off) anything that cannot be verified as legitimate without opening.
 
surely there is a law against this stuff? after all, if it came through the post, you would call the Gardai in,
--------------------------------------------------------------------------------
There is no law to prevent sending adult pornography via email. However, child pornography is a different matter.

SPAM is a major problem for many companies and there is a law in Ireland. The provisions of Statutory Instrument 535 of 2003 [European Communities (Electronic Communications Networks and Services)(Data Protection and Privacy) Regulations 2003] which took effect on November 6th 2003. Since that date, the sending of unsolicited electronic communications from within the Republic of Ireland for the purpose of direct marketing has, in certain situations, been an offence. This is punishable by the offender being fined up to €3,000 per email. More info available from the Data Protection web site [broken link removed]

However the above law only applies to those sending SPAM from within Ireland. As most SPAM comes from the US this law has little impact. There are two cases pending by the Data Protection Commisioner against companies sending SMS SPAM- from the Irish Examier "[broken link removed]

As Clubman also pointed out there are numerous packages available to prevent SPAM. Some are more effective than others and range in terms of functionality, costs and ease of use. If your company decides to deploy a solution it needs to take into effect how much overhead this will place on the company. This will be from the point of view of administering the system and dealing with legitimate emails being classified as SPAM.

There are numerous ways to get on a SPAMmers list and you do not necessarily have to visit pornography sites to get on the list. As someone pointed out earlier accusing colleagues without hard evidence is very shaky ground to be on.

Here is some information on SPAM that I have collated over the years

What is SPAM?
SPAM emails are Unsolicited Emails or bulk emails used to promote material that is very often not wanted or applicable to the recipient. The content of SPAM emails can also be immoral, illegal and offensive.

How did my email address get on spammer’s list?
Your email address can get on spammers’ mailing lists by several routes.
(1) The most common is posting a reply to a newsgroup on an Internet website.
(2) Spammers also use automated programs that crawl through websites and newsgroups harvesting anything that looks like a valid email address.
(3) Another common method is by people subscribing to email lists or filling in forms on websites that do not have proper privacy policies in place.
(4) Many spammers also have automated programs that guess the email address of the recipient.
(5) Finally there is a lucrative market where spammers exchange and sell their list of email addresses to each other. A CD with millions of addresses can be bought for $10

Can’t I simply unsubscribe to the email to stop receiving SPAM?
Never reply to a spam email, even to unsubscribe, as this simply confirms that your email address is an active address and more spam will subsequently be sent

How do I reduce the amount of SPAM I am receiving?
To following steps can help reduce the amount of SPAM you receive;
(1) Never reply to a spam email, even to unsubscribe, as this simply confirms that your email address is an active address and more spam will subsequently be sent.
(2) Never open a spam email. These emails often have hidden scripts or programs in them that acknowledge back to the spammer that your address is active and real.
(3) Never post your real email address on an online web site or bulleting board. People who send SPAM scour these sites to collect legitimate email addresses. If you do have to include your email address, try using the format “youraddress at somewhere.com” rather than “youraddress@somewhere.com.”
(4) When filling in any form on the Internet read very carefully the conditions upon which your personal information, such as your email address, will be used. Ensure that you read carefully the website’s privacy policy and make sure to check or uncheck the boxes that allow emails to be sent to you.
(5) Use a filtering solution to prevent spam from reaching your mail server. This will reduce the amount of spam that the users get and also reduce the overhead on your network and email system

Is it illegal to send SPAM?
The Irish minister for communications, Dermot Ahern, recently introduced new legislation to help deal with SPAM. Under this legislation individuals must opt-in, or agree to receive, marketing emails from companies, while marketing emails to businesses must be as a result of a pre-existing relationship. This in effect means that people receive emails only from companies that they want to receive emails from. Any organisation breaking this new law can be fined up to €3,000.00 per unsolicited email message sent.

While this is a positive step towards eliminating SPAM, there is still a long way to go. The above legislation only applies to emails originating from addresses within the EU. As the large majority of SPAM is sent from addresses in the United States and Asia, the impact this legislation will have on SPAM from those sources will be negligible

How big is the SPAM problem?
The SPAM problem is quite large and is growing larger each day. Recent surveys by the Gartner Group indicate that SPAM emails can account for up to 50% of emails, which in effect means that 50% of your email traffic could be SPAM.

Does SPAM pose any risk to my business?
SPAM emails are becoming a major threat to businesses as they clog up expensive Internet and network connections with unnecessary traffic and expose recipients to unwanted and indeed unsavoury content. Each SPAM message has to be processed by your network and your mail server, this adds costs and overheads to the running of your network. The content in SPAM emails is often of unsavoury content and can expose your business to litigation by employees for sexual harassment or criminal proceedings if the SPAM emails contains illegal content, such as child pornography. There is also the productivity issue as employees sort and deal with the deluge of unwanted email in their inboxes and the invariably lost legitimate email accidentally deleted when dealing with SPAM.

Recently, it has been discovered that SPAM emails are also being used to transport computer viruses and spyware (software that secretly collects personal information and sends it back to a third party), which pose a threat to the stability and security of your business.

Why can’t the computers that spammer’s use be simply prevented from connecting to the Internet?
The people who send SPAM emails are constantly adopting to ensure they can remain in business. Many use ISPs and servers in countries where there is very weak or no legislation in against sending SPAM. They also exploit unprotected email servers to send SPAM on behalf of the spammer. Recent computer viruses install software on the infected PC to enable the PC, without the owner knowing, to be used to send SPAM. According to an article in USA Today, the going price to rent a network of 20,000 PCs infected with this type of virus is $2,000 to $3,000.

How much does SPAM cost my business?
SPAM impacts the bottom line for your business in a number of ways. Firstly the cost to your business of downloading storing and backing up SPAM has to be taken into account. A Gartner Survey estimates that 50% of all email traffic is SPAM, this means that 50% of the money your business spends on bandwidth for email, storage for email and processing of email is being spent so that you can receive SPAM.

There is also the loss of productivity to take into account. On a per employee basis, if the employee if on an average salary of €27,500 per year and they receive up to 30 emails a day with each SPAM email taking 2 seconds to be dealt with. This translates into an annual cost per employee of €57. For a company with 100 employees the annual cost due to SPAM in lost productivity alone would be €5,700.


Why is SPAM called SPAM?
Spam is a tinned meat product, so what is the connection with the electronic version of SPAM? Legend has it that the term SPAM comes from a comedy sketch in the British TV comedy series, Monty Python’s Flying Circus. The sketch shows a waitress in a restaurant listing the various menu dishes containing spam to a customer, while in the background a group of Vikings begin incessantly chanting the words “spam,spam,spam .. “ until the waitress can no longer be heard.

In the early days of the Internet, SPAM became the reference for people who excessively posted items into message boards and newsgroups. The term subsequently became used for unsolicited emails and bulk emails.

C
 
Hi jasconius

I think your approach has been entirely reasonable. You suspected that someone may be downloading pornography. This may not be illegal, but it should certainly be against the internet usage policy of your company. You reported your suspicion to the MD, who has decided to take no further action. This is not a court of law. You became suspicious and reported it. You were absolutely right to do so, as long as it was not malicious.

We use a product from Topsectechnology, an Irish company which is 99% effective against spam and, so far, 100% effective against viruses. It costs small companies €1250 a year and is well worth it. It does not stop emails with the word asset in them. It quarantines some false positives, but as far as I know, it has never deleted a false positive. This is about the best IT product I have bought for the office.
 
Hi jasconius,

Does your company have a well drafted, communicated and understood Internet/e-mail policy?

Such policies if developed and deployed properly can be invaluable in dealing with situations like you describe.

Personally I prefer working in an environment that has such policies (even if I dont agree with some of the provisions).

ajapale
 
I think your approach has been entirely reasonable. You suspected that someone may be downloading pornography.

Whether or not the approach is reasonable would depend on the evidence on which the presumption of guilt in the matter of downloading unacceptable material was based. On the basis of what was posted so far I'm not so sure that reporting against an individual is reasonable.

This may not be illegal, but it should certainly be against the internet usage policy of your company.

Perhaps it should be but, in actuality, many companies have no acceptable usage policies at all in place for resources such as email/internet and, in such cases, it may be difficult to make alleged abuse of the resources a disciplinary matter. There was one case here in Dublin a while back (can't find the details right now) where an employee was sacked for downloading porn and the company was found guilty of unfair dismissal because they did not have a policy stating that this was unacceptable.
 
Spam

Firstly, all orgs should have a policy on internet and email useage. Everyone then knows what is/is not allowed.

"if the IT manager were to regulate UTV spamfilter?, we would lose some of our normal Emails which may contain a word like 'asset' or such-like which could be 'misinterpreted' and filtered out."

Some orgs filter all 'suspect' emails and, to get around the problem you mention above, send an email to the intended recipient alerting them to the emails arrival. They must formally request access to it if they think its legitimate.
 
spam

Hi,

As well as recommending your IS dept to invest in good security filtering tools there are a couple of things you can do.

- Most people have more than one email address for the same account (quite frequently without knowing it). So for example joe bloggs at the acme company could have:

joe.bloggs@acme.com
jbloggs@acme.com
joe@acme.com

You can find these listed under your smtp properties for your account. When I had problems with spam I got my IS dept to delete all extra email addresses and now only joe.bloggs@acme.com will work. This reduced my spam from approximately 250 mails a day to a couple a week.

- Never set your out of office mail. Spam comes in and the out of office replies and hey presto they know they've hit an account and you are on a load more lists. I know this might not be possible and I work with clients, but now when I go abroad I contact them individually first.

Hope that is some help
Cas.
 
Re: spam

Hi Cas

I never heard this downside to Out of Office Reply before and it seems like very good advice.

Brendan
 
Re: spam

Any reply, including automated ones, to spam may simply confirm your address as a "hit" to spammers. The same goes for any opening, including by a preview pane, of messages. This is why it's a good idea to switch off the preview pane particularly if you don't employ any spam filtering.
 
Re: spam

Brendan

Out of Office replies also cause problems when major virus outbreaks occurs. If you have the out of offie reply set on your email and a number of virus infected emails are sent to you, then this can cause increases in network traffic. Often one of the bigger problems during a virus outbreak is the slowdown in network and Internet traffic due to the large increase in emails.

One answer is to have some sort of SMTP (the email protocol) challenge at the network perimeter, a number of vendors provide black box devices to connect onto your network. This also drops the non delivery reports for non-valid emails on your domain and can ensure emails are coming from legitimate sources. Or you can outsource to a company that specialises in this as you have done.

C
 
Back
Top