/

UUNET cracks down on spam

By Todd Wallack and Adam Gaffin
Network World

UUNET Technologies has agreed to crack down on spam, after being sentenced to the "Usenet Death Penalty" last week for ignoring junk e-mail complaints.

The major Internet service provider yesterday said it plans to filter unauthenticated Usenet postings, stop relaying third-party mail to non-UUNET destinations and use new tools to identify the source of spam.

In addition, UUNET said it already limits the length of e-mail lists, blacklists known spammers, maintains a complaint box (abuse@uu.net) and investigates and takes action against spammers.

"We've been working behind the scenes ... to stem the flow of spam and we've stopped a lot of offenders," said UUNET CEO John Sidgmore in a prepared statement. "However, current technology makes spamming easier, so we've found it necessary to strengthen our antispamming measures."

Last week, a loose coalition of about 20 Usenet users accused UUNET of ignoring the problem for too long, and sentenced the backbone provider to the "Usenet Death Penalty." System administrators unleashed an army of programs called "cancelbots" to delete any Usenet postings from uu.net accounts.

"We're cautiously optmistic," said Sean Fagan, a system administator from San Jose, Calif. "The (death penalty) is likely to be lifted today, at least temporarilly."

Prior to the protest, Fagan said UUNET users were sending out as many as 250,000 spam postings a day - a quarter of all Usenet traffic - and inundating news groups. Even Internet users looking for information on Disney comic books had to deal with ads for sex-related Web sites. The traffic also was causing headaches for administrators of the NNTP servers that make up Usenet.

But over the last few days, the flood of spam has slowed to a trickle. Fagan said the levels dropped from more than 90,000 junk postings a day to roughly 2,800. So far today, the numbers are even lower.

Fagan said it's too early to tell whether the numbers are dropping because of UUNET's countermeasures, or simply because the "death penalty" has driven spammers away. In any case, Fagan said only a handful of users with UUNET dial-up accounts were affected because most users have their own Internet domains, as do ISPs that buy service from UUNET. "Out of over 50,000 articles cancelled, less than three dozen were legitimate," said Fagan, who has operated a Usenet node for about eight years. "This is the kind of statistic that drove us to this action."

Still, UUNET said it has taken "technical measures" to counter the cancelbots and contacted law enforcement officials about the matter. Sidgmore told the Washington Post it was "digital terrorism."

"These people are not government agents or the police. They have absolutely no right to cancel service on someone else's infrastructure," Sigdmore told the paper.

It is not clear, however, whether the action falls under any criminal statutes. And Fagan insists the users had no choice. "UUNET has done nothing," Fagan said Tuesday. "They have claimed that they can't, or they have simply ignored all complaints."

He said a system administrator last week reported than more than 1 million messages had passed through his system in one day - and just 20% were nonspam. About 40% were spam and another 40% were cancel messages intended to counter the junk e-mail.

Ironically, the "Usenet Death Penalty" could sharply increase the burden on system administrators with thousands of additional cancel messages. But Fagan said the group did not have much choice. If they did not act now, the amount of spam could reach the point where it would no longer be possible to remove them - renderinging newsgroups completely useless. One of the leaders of the antispam movement also appears to have been hurt by the protest.

Scott Hazen Mueller, a founder of the Coalition Against Unsolicited Commercial Email (CAUCE), which is seeking a federal ban on spam, also runs five moderated Usenet conferences from a UUNET account, including comp.newprod, comp.sys.sun.announce and rec.arts.sf.announce.

Because of the moderation, all messages must go through his UUNET account, which means the groups are now effectively dead. He added, however, that he can no longer access his acount on the UUNET server and is not sure whether UUNET cut him off deliberately.

Mueller said he had nothing to do with the protest, but said he sympathizes with it.

"I fully support every one else turning their back on (UUNET)," he said. He said spam has become a major problem on Usenet and a major headache for people who administer Usenet servers, which range from tiny one-person Linux machines to international ISPs. He estimated that 70% of all Usenet messages are now either spam or "cancel" messages sent out to delete spam.

Mueller, vice president for engineering at Whole Earth Networks, a San Francisco-based ISP, said all the messsages are beginning to cause serious I/O problems on servers. All the disk writing that has to be done to store the initial spam on hard drives and delete them when a cancel message comes in from any of several "cancelbot" services. Whole Earth now sees 1 to 2 G bytes of Usenet postings a day, he said.

Mueller said the protest is yet another sign of serious trouble on the network, although he added that "people have been predicting the death of Usenet for about 17 years," or about as long it's been around.

The "Usenet Death Penalty" has long been used as a joke during particularly heated discussions about people who post the same message to multiple newsgroups. And antispammers have long tried to block messages from specific spammers.

Users even tried to block Bell Atlantic postings for a few days to protest spam. But Mueller and Fagan said this appears to be the most concerted effort ever made against an entire ISP.