Spam

• What is spam?
• Is Boreal doing anything about spam?
• How did they get my e-mail address????
• What can I do about spam?
• More information

• What is spam?
  Spam, also known as Unsolicted Commercial Email (UCE), is the junk mail of email. While there isn't total agreement as to what constitutes spam (other than processed ham), basically a message is spam if:
  1. It's bulk mail - a generic message that isn't personally directed to you. (NOTE: just having your name "plugged into" a generic message doesn't make it personally directed to you.)
  2. You didn't ask for it or agree to receive it.
  3. The sender has more to gain from sending the email than you do from receiving it. The decision as to who has more to gain is totally yours - the recipient's.
  (NOTE: These criteria are based on the spam definition published by MAPS. Visit their site for more details.)
  
  
• Is Boreal doing anything about spam?

Yes! Boreal has installed a mail filtering system called Spamassassin. Spamassassin scans all incoming messages for common spam characteristics, and if it finds enough, it flags the message as spam. How it's handled at that point depends on what spam-handling option you're using (see the options below). More information about Spamassassin and the tests it performs can be found at spamassassin.apache.org.

You have several options for using spamassassin:

• Option 1: All your incoming mail is filtered through spamassassin. Any mail identified as spam is deleted. If you want this option, you don't need to to anything. By default, all Boreal members use this option.
• Option 2: All your incoming mail is filtered through spamassassin. Any mail identified as spam is moved to a special Spam folder, and you can access these spam messages via Boreal's web mailer. Spam messages are stored in this folder for 10 days, then deleted. If you want this option, please contact the Boreal office.
• Option 3: None of your incoming mail is filtered through spamassassin. If you want this option, please contact the Boreal office.


• How did they get my e-mail address????
  Spammers have lots of ways of getting e-mail addresses. A few are:
  • Usenet groups: If you've ever posted a message to a public bulletin board or newsgroup, your address is out on the internet and easily accessed by spammers. NOTE: Using Boreal's mailing lists, such as news and for-sale, will NOT result in your email address being made accessible to spammers. Boreal's lists are private mail lists, not publicly accessible Usenet groups or bulletin boards.
  • Bots: Spammers use programs called "bots" to search through the internet and "harvest" e-mail addresses from web pages. If your e-mail address is published on your web page, a bot can pick it up as it's compiling a list of addresses for spammers. This is especially true if your page is listed in a search engine. Some ways to make it harder for bots are:
    • If you've published your email address on your web page, don't publish it in a "mailto" link - ie. the person looking at the page just clicks on your address to send an email. The "mailto" addresses are easiest for bots to harvest.
    • Some people disguise their email address so bots won't get the right address, but people will. For example, if your address is jsmith@boreal.org, publish it as jsmithDELETETHIS@boreal.org.
  • Opt-Out lists: Some places will tell you to send them your email address and they'll take you off spammers' lists. Use these with caution - unfortunately some of them actually turn around and sell your email address to spammers.
  • Web page: If you visit a spammer's web page, he/she may use hidden code on that page to get your email address.
  • Viruses: There are many viruses which allow hackers access to your computer if your computer has the virus. Some spammers take advantage of these viruses to access personal computers and harvest the email addresses in people's address books.
  • Online forms: Before you give your email address to a company via an online form, make sure that the company has a policy not to sell your email address. Look for a box on the form that asks if it's ok to send related offers or information to you - make sure it isn't checked.
  • Dictionary attacks: It doesn't cost the spammer anything to send mail to an invalid address, so many spammers "guess" at email addresses by using common names and domains and going through the alphabet. For example, they'll send messages to johna@boreal.org, johnb@boreal.org, johnc@boreal.org, johnd@boreal.org, etc., hoping that a few of those messages hit a valid address.
  
  
• What can I do about spam?
  First, what not to do:
  • Don't reply - Many spam messages will tell you you can get off the spammer's list by replying with an "unsubscribe" message. Don't do it! You will probably end up either
    1. getting your message returned to you as undeliverable, or
    2. getting even more spam.
    This is because
    1. Most spammers forge their return address. Usually it's a totally fake address, but sometimes it's the address of some innocent person the spammer wants to irritate by tricking you into sending them mail.
    2. If your reply actually gets through to the spammer, it just confirms that someone is receiving email at this address. This makes your email address more valuable, and the spammer can (and will) sell it to other spammers.
  • Don't buy what they're selling. If spam didn't work, spammers wouldn't use it. Spam is not generally considered to be a reputable way of advertising - even if their product looks attractive, buy it from a more reputable source than a spammer. (Spammers almost always forge their return addresses so you can't find out who they really are - do you really want to send your money to a person who goes to such lengths to be un-traceable?)
  • In some cases, responding to spam can be dangerous. Most spam is just irritating, but there are also many scams and frauds now being carried out via spam mail. Probably one of the most common (and dangerous) is the Nigerian Advance Fee Fraud, where someone from Nigeria or a nearby African country will promise you several million dollars in return for letting them use your bank account to transfer funds out of the country. People who've responded to this scam have lost thousands of dollars, and in some cases have even been lured into situations where they were kidnapped and held for ransom or killed. Information on this scam can be found at http://www.crimes-of-persuasion.com/Crimes/Business/nigerian.htm

  Here's what you can do:
  • Report it to the spammer's Internet Service Provider (ISP) - This helps to cut spam off at the source. Every spammer has to go through an ISP, and most ISP's have very strict rules regarding sending spam using their service. If an ISP is made aware that someone is sending spam through them, they can take action against the spammer.

    The problem: Spammers know that their ISP will be upset to find out about their activities, so they do everything they can to disguise where they're sending from. The return address you see on your spam mail is almost always a fake, so reporting to that ISP does no good. Fortunately, there are ways to get around this:

    • spamcop.net - This site will let you send them your spam, they'll decode the headers to find the true source of the spam and send a complaint to the proper people. This is a free service, but be sure to read the directions for using the service first.
    • This solution is only for you techie people! You can go through the message's headers to locate the IP address of the actual sender, look up that IP Address, and then send a message to their abuse desk. This is a complicated process, but fortunately it's explained in many places on the Internet, including:
      • Displaying headers: Helpful Hints on How to Show Full Headers
      • Decoding headers: Spam Series
      • Site to look up an IP Address: DSN Stuff tools - go to the IPWHOIS Lookup in the middle of the page.
      • Site to look up the best email address to use to send a complaint to the ISP: Abuse.net's contact database
  • Filter your email - There are two ways to do this:
    • Get filtering software or a filtering service. A few sources for these are SpamCop's Advanced Filtering Service and Top 10 Spam Control Tools, Choose your mail.com. NOTE: Boreal already filters all mail sent to your boreal.org email address. This means most spam is filtered out before it gets to you. Additional filters may or may not be helpful - many will filter using the same criteria Boreal does.
    • Set up a your own filter in your e-mail program. If you can identify some characteristic that is unique to the spam messages (for example, they have the word "advertisement" somewhere in the message), you can set up your email program to look for messages with that characteristic and delete them before they get into your mailbox. For instructions on setting up a filter, see the E-Mail Filters section of this FAQ. CAUTION: If you make your filters too general, you may start filtering out mail you want. For example, if your filter deletes every message with the word "buy" in the message body, and your sister sends you an email asking if you want to go in and help her buy a gift for your mom, your sister's message will get deleted along with the spam because it contains the word "buy". Make sure your filter checks for something that only spam mail has!
  
  
• More information:
  • There's a long list of spam information / anti-spam sites at http://dir.yahoo.com/Computers_and_Internet/Communications_and_Networking/Email/Spam/
    
  • This site has a lot of information on what to do about spam: http://www.spamabuse.org/content_DelaingwithSpam-WhattoDo.htm

Contents © 2000 Boreal Access. All rights reserved.