Archived—Proposal for the Canadian Anti-Spam Action Centre

Archived Information

Archived information is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Task Force on Spam
May 2005


PDF Version (137 KB - 9 pages)


Background

Canada's Task Force on Spam has taken a toolkit approach to fighting spam. This multifaceted strategy includes a review of legislative measures, better enforcement of existing laws, technological solutions, consumer education and awareness, and international collaboration. It calls for a highly synchronized, coordinated approach to spam prevention and enforcement. In enforcement, in particular, the Task Force has revealed the need for more effective communications, cooperation and collaboration, as there are many law enforcement and regulatory bodies that each have partial, but less than complete, responsibility for dealing with the spam problem.

Key challenges identified through the work of the Task Force include:

  • the existence of multiple jurisdictions for spam investigations;
  • the availability of technical expertise to conduct investigations;
  • the need for adequate resources to fight spam;
  • the ability of the technical/network operator community to share information;
  • the need for sound metrics to describe the spam problem;
  • the need of Canadians to have access to reliable, accurate information on how to protect themselves from spam;
  • the need of Canadians to have a clear process and a focal point to which they can direct complaints; and
  • the need for domestic and international coordination and collaboration.

Canadian Anti-Spam Action Centre

All of the preceding point to the need for a focal point or responsibility centre that would better coordinate the fight against spam in Canada. Therefore, this paper proposes the establishment of the Canadian Anti-Spam Action Centre (CASAC).

This centre would become the major vehicle for more effective policy oversight and coordination, and for providing increased support to law enforcement.

CASAC would lead the fight against spam by providing policy oversight and coordination, specifically by:

  • developing policy approaches to the issue of spam and spam-related threats, including monitoring and analyzing issues and maintaining ongoing consultations with key stakeholders;
  • collecting and compiling information, metrics, and statistical data to measure the spam problem and benchmark the effectiveness of anti-spam measures, and reporting to the public, as appropriate;
  • providing the public with information and other resources, as well as support and referral services, to help Canadians keep themselves safe from spam; and
  • encouraging international and domestic public, private, and academic sector collaboration in the fight against spam.

CASAC would also support law enforcement by:

  • receiving and analyzing submissions and complaints from the public about spam and spam-related activities, and referring leads to the appropriate law enforcement or regulatory agencies; and
  • providing technical expertise in support of prospective and ongoing investigations.

This proposal outlines a concept that has already been developed or is currently under development in other nations around the world. For example, the Association of the German Internet Economy e. V. coordinated an anti-spam task force in Germany that resulted in the creation of the Spotspam pilot project.

Function I: Policy Oversight and Coordination

Promoting National Anti-Spam Coordination

Currently, resources to fight spam are spread across a number of organizations with a variety of mandates not strictly related to fighting spam. These various organizations must allocate their resources considering their own competing priorities. As is stands, fighting spam is not always a primary line of business for these organizations, so adequate and coordinated funding is often lacking.

CASAC would work in close cooperation with all government agencies engaged in anti-spam activities. It would be in a position to provide coordinated resource management for these initiatives, ensuring efficiencies by, for example, eliminating duplication.

Conducting Public Education and Awareness

Public education and awareness are among the most critical tools in the fight against spam. Canadians need accurate information on how to protect themselves from spam and spam-related activities (e.g. phishing). Although there is significant information available, particularly on the Internet, concerning spam and spam-related activities, this information is not consistent, and is sometimes contradictory.

The Centre would be uniquely positioned as the entity that collects spam and related information in order to provide cutting-edge, accurate, reliable information and education to the public about spam and spam-related activities. Its education and awareness functions would include proactive education and awareness initiatives to prevent Canadians from becoming victims of spam and spam-related activities. PhoneBusters has a unique communications approach that could serve as a model for CASAC.

Promoting International Cooperation in Fighting Spam

Various elements associated with spamming often tend to cross borders. To address this, international cooperation is essential.

CASAC would function as a national coordination centre to collaborate in international investigations related to spam. The Centre would also build relationships and foster collaboration in general with international partners, including by entering into international arrangements that promote anti-spam cooperation among countries and within multilateral organizations such as the Organisation for Economic Co-operation and Development and the International Telecommunication Union.

Function II: Providing Support to Law Enforcement and Regulatory Agencies

Receiving Complaints

The responsibility for handling spam complaints is shared between many organizations. As a result, both Canadians and Canadian organizations are unclear on where to direct spam complaints, with some not even aware that complaints can be made and others possibly complaining to the wrong agency.

CASAC would be prepared to be a focal point for all spam complaints. As such, it would be in a position to measure the magnitude of the problem, which would be indicated by the number of complaints. Further, the Centre could assign analytical resources to deal with these complaints as appropriate. This would very simply provide Canada with a clear process through which complaints could be made and dealt with. Following proper analysis (further discussed in the following section), these complaints could be forwarded to the appropriate enforcement agency, as necessary.

Maintaining a Canadian Spam Database (the Spam Freezer)

The Canadian spam database would be a repository where email users could send copies of spam received in their email inboxes. Spam messages sent to this database would be inventoried and kept for a prescribed period of time by CASAC.

The concept of this Canadian spam database would be similar to those of the United States' Federal Trade Commission's spam database, the U.S.'s Anti-Phishing Working Group's (APWG's) database, and Canada's PhoneBusters' database of telemarketing complaints.

The Canadian spam database would provide a system for receiving and storing examples of spam submitted voluntarily by Canadians. The database would provide Canadian victims of spam with a trustworthy, effective reporting mechanism to help in efforts to enforce Canadian laws applicable to spam and spam-related types of email abuse.

The database would also be a resource for agencies involved in preventing the effects of spam, prosecuting those responsible, or obtaining appropriate relief from the effects of spam and spam-related types of email abuse. This resource would primarily be made available to the law enforcement community, Internet service providers, research organizations and other relevant agencies, such as Industry Canada. Information on spam affecting, sent by or generating profit for Canadians may be used as evidence for legal efforts, in the analysis of statistical data, and as the basis for determining Canadian government policy.

Providing Technical/Analytical/Investigative Expertise

Right now, a great deal of technical forensic expertise is required in order to investigate a serious spam complaint. The responsibility for investigating such complaints can potentially fall on a number of organizations, including, for example, the Competition Bureau, the Office of the Privacy Commissioner of Canada, the RCMP, or even local police forces, and it has become clear that not all organizations possess resources with the required technical and specialized investigative expertise.

CASAC would have technical experts capable of dealing with the complex nature of spam complaints and investigations. This would address the lack of technical expertise and also eliminate the need for all implicated organizations to host this expertise, thereby resulting in a significant cost savings.

The Centre would be able to help facilitate investigations by receiving complaints and storing evidence, as described. It would also undertake preliminary investigations, with its in-house technical expertise, then forward complaints along to the appropriate enforcement agency, along with its preliminary analyses.

CASAC could also provide real-time data relating to current spam trends in order to support real-time action against serious threats, such as phishing attacks.

Enabling the Sharing and Exchange of Information on Spamming

A key tool in the fight against spam is accurate, timely information. Also important is the exchange of this information between key stakeholders. Network operators, in particular, must collect and share information about spammers on their networks.

CASAC would function as a focal point for the exchange of information between private sector representatives, including network operators, and other relevant stakeholders. This exchange could prevent the proliferation of spammers on Canadian networks.

How the Centre Could Be Organized

CASAC could be organized in several different ways. While a new organization could be created, locating the centre in an existing organisation would have several advantages, including lower costs.

One option would be to launch a new public-private sector partnership or to give the responsibility to a third-party private organization. An example of this model would be PhoneBusters. A potential drawback to this option, however, would be that it might not meet all of the requirements associated with CASAC's dual mandate of providing policy oversight and coordination and support to law enforcement and regulatory agencies — particularly the former.

A second option would be for the Centre to be operated by an existing regulatory agency. The Competition Bureau plays a significant role in combatting spam. However, the Bureau focuses only on certain varieties of spam-related offences, particularly those related to misleading content, and does not have a mandate to pursue spammers in relation to privacy concerns. Other potential hosts include the Office of the Privacy Commissioner of Canada and the Canadian Radio-television and Telecommunications Commission. The complication in choosing an existing regulatory agency is that there are many law enforcement and regulatory bodies that each have partial, but less than complete, responsibility for dealing with the spam problem.

A third option would be for the Centre to be located in an existing government department. Industry Canada would be uniquely positioned as the policy centre for Canada's fight against spam.


Appendix

Summary of Existing Models

PhoneBusters

Established in January 1993, PhoneBusters is a national anti-fraud call centre jointly operated by the Ontario Provincial Police, the RCMP and the Competition Bureau. PhoneBusters plays a key role in educating the public about specific fraudulent telemarketing pitches. The call centre also plays a vital role in the collection and dissemination of victim evidence, statistics, documentation and tape recordings, which are made available to outside law enforcement agencies.

The original mandate of PhoneBusters was to prosecute key individuals in Ontario and Quebec involved in telemarketing fraud under the Criminal Code of Canada. Its mandate now also includes facilitating prosecution by U.S. agencies through extradition, and by the Competition Bureau under the Competition Act.

PhoneBusters is the central organization in Canada collecting information on telemarketing, advanced-fee fraud letters (West African fraud letters) and identity-theft complaints. A key function of PhoneBusters is its collection and analysis of information and evidence, which is then presented to law enforcement for investigation. The data collected by PhoneBusters is a valuable tool in evaluating the effects on the public of various types of fraud. It also helps in preventing future similar crimes. A main focus of PhoneBusters, which receives partnership funding from the private sector, is public education and awareness.

National Child Exploitation Centre

The National Child Exploitation Coordination Centre (NCECC), an integral part of Canada's National Police Services, was created to help protect children from online sexual exploitation.

The NCECC is a national clearing house and coordination centre for all international requests to conduct investigations in Canada related to child sexual exploitation on the Internet. The Centre also provides support to peace officers, particularly investigators involved in files dealing with child sexual exploitation on the Internet. The NCECC builds relationships and collaborates with domestic and international partners to raise awareness and combat criminal activity that targets, exploits and abuses children. In addition, the NCECC will help to develop standards and guidelines within Canada, and will provide many levels of support to law enforcement investigators involved in files dealing with the sexual exploitation of children on the Internet.

Cybertip.ca

Cybertip.ca is Canada's national tip line for reporting online sexual exploitation of children. It is a centralized Web portal for receiving and addressing reports from the public about child pornography, luring, child sex tourism and children who are exploited through prostitution. Cybertip.ca also provides the public with information, referrals and other resources to help Canadians keep their children safe while on the Internet.

As Canada's national tip line, Cybertip.ca's mandate is to protect children from online sexual exploitation by receiving and analyzing tips from the public about potentially illegal material and activities regarding online sexual exploitation of children, and referring leads to the appropriate law enforcement agencies; and providing the public with information and other resources, as well as support and referral services, to help Canadians keep themselves and their families safe while on the Internet.

Reporting Economic Crime Online

Reporting Economic Crime Online (RECOL) is an initiative that involves an integrated partnership between international, federal and provincial law enforcement agencies, as well as regulators and private commercial organizations with legitimate investigative interests in receiving copies of complaints about economic crimes.

User-controlled consent is required to direct fraud complaints to the appropriate law enforcement and regulatory agencies. RECOL recommends appropriate law enforcement or regulatory agencies and/or private commercial organizations for potential investigations.

The initiative also provides real-time data related to current fraud trends, and provides support for education and awareness about, and prevention of, economic crime.

The privacy of all data entered by a user is protected, and the information can only be accessed by the user who entered the original complaint data. All members involved in the RECOL initiative provide oversight to ensure the privacy of RECOL content and that the information is only used to help in the investigation of economic crime complaints.

The RECOL service is administered by the National White Collar Crime Centre of Canada, and is supported by the RCMP and other participating agencies.

Operation Slam Spam in the United States

Operation Slam Spam is a cooperative Direct Marketing Association / Federal Bureau of Investigation (FBI) effort in which the DMA is dedicating funding and intelligence to help the FBI identify and criminally prosecute spammers.

Operation Slam Spam has identified more than 100 "significant" spammers. In addition, it has:

  • targeted 50 spammers as points of focus for the project;
  • developed 10 primary subject packets for referral to law enforcement;
  • linked three groups of subjects into potential organized criminal enterprises;
  • referred five major investigations of spammers;
  • identified more than 350 compromised resources, including 50 government sites;
  • engaged military criminal investigators to help identify criminal acts associated with compromised government sites; and
  • catalogued techniques being used by spammers, including email harvesting, use of viruses, and the use of turnkey tools to bypass filters.

Anti-Phishing Working Group in the United States

The APWG is a U.S. organization committed to wiping out Internet scams and fraud.

Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and financial account credentials. Social-engineering schemes use "spoofed" emails to lead consumers to counterfeit websites designed to trick recipients into divulging personal and financial data, such as credit card numbers, account usernames, passwords and social security numbers.

Hijacking the brand names of banks, e-retailers and credit card companies, phishers often convince recipients to respond. Technical subterfuge schemes plant "crimeware" onto personal computers to steal credentials directly, often using Trojan keylogger spyware. "Pharming crimeware" misdirects users to fraudulent sites or proxy servers, typically through DNS hijacking or poisoning.

Through the APWG website the public can report phishing emails, pharming sites and malicious spyware to the APWG to help stop these threats to payment systems and the e-commerce infrastructure. The website also provides access to anti-phishing resources, including consumer advice on phishing.