S.KRAUSE

Spam and Phantastic Phishing Phun: the IRS

My first spam arrived in 1997 or so, and not to one of my main accounts but to a secondary email address I had at a Hungarian university. At the time they had not yet disabled my access, so from Madison I logged in via telnet (no ssh at the time), only to be offered some form of anonymous treatment and support for some unspecified sexually transmitted disease. Since I had never experienced bulk junk-mailings before, I simply concluded that the message had to be somebody's idea of a bad joke.

Only later did I start receiving spam after spam, first at my free web-based accounts, and then at my university account, which now, curiously enough, receives more spam than all the others combined, even though it is the one I do not use online—furthermore, UW's filtering capabilities are weak, and 90% of the messages arriving to my inbox are junk.

But that first spam—before the deluge of Viagra ads, before penis enlargement, before “YOU MAY HAVE WON!” and before reduced rate loans, job offers, and the like—was a historical curiosity, of course not the first spam, but my first spam.

And that forces me to wonder, what was the first spam ever? If we limit ourselves to e-mail, which is a reasonable enough choice, we will likely never know, though one message has been traced to 1978. I supposed it was possible but impractical to mine the archives and history of USENET to find the first commercial, bulk message to that medium, and we would still have to deal with a matter of definition in deciding what content or behavior qualifies (commercial, religious, political, bulk, channel-flooding, etc.), but various Wikipedia pages cite documentation that indicates some of this research has been done, and the entry on spam discusses briefly spam-precursors in other media, while also noting that “[c]spamming started in force on March 5, 1994” with Cantor & Siegel.

1994—I am glad that I spent little time on USENET back then and that I had to wait three years for my first spam email.

Yet I think also about the first 419 email I received, but deleted, and the first phishing attempts sent to my addresses. These two are specific enough that I could have archived and documented them over the years, but in each case I deleted the offending message upon arrival. Legion are the messages that I could not have made any sense of, those in strange character sets and at times seemingly with no recognizable content at all.

The other day I got my first example—followed a day or two later at a different address—of what was, to me, a new phishing scheme. Paypal, eBay, and Amazon.com were the first I ever received, followed by credit cards, banks, and credit unions, but the other day it was the IRS.

For documentation purposes, I am providing the URL, which pointed to dghualon.com, as well as the redirect to ap.ro—report phishing attempts to phishing@irs.gov

The sad fact seems to be as follows: these scams are economically motivated. As certain amount of resources must be expended to construct and carry out these scams, which, despite the increased automation provided by computers, still requires a human element. If ascribe at least a minimal amount of rationality to the actions of these criminals, we have to conclude that they at least believe this to be a profitable enterprise (and as good or better than the alternatives, which, are, of course, dependent on context), and they probably have some evidence to back this up, leading us to surmise that enough people fall for these absurd and transparent schemes to make it worthwhile.

The first 419 email I received did not come until 2001 when I was working for Monatshefte, though since then the ALL-CAPS SUBJECT LINES and polite forms of address have become a commonplace in my inbox and bulkmail folders. They are more formulaic than the latest Hollywood blockbusters and flops, which would lead one to believe that an automatic generator exists out there for these documents. The ones I have received have claimed to come from men and women, from all throughout Africa, but also the Middle East, Southeast Asia, and the former Yugoslavia.

Of course these messages did not stop with email, and have since moved on to other messaging formats, such as blog comments and social networking sites. The following, for example, was received as a message at Friendster, and has been edited only slightly for presentation/formatting (but not content):

I like to think that there was an age without spam and scams, but the Spanish Prisoner is a confidence game that in form clearly predates its specific instance and naming, and as long as there has been electronic messaging (telegrams, email, news groups, etc.) the same scams have been propagated, though I hesitate to invoke the word meme. The template + instance nature of most of these enterprises, however, at least seems to indicate that complex social structures support them, and that across media similar (social) structures arise.

Critical mass, public and private communication across distances, relative anonymity and bringing people together who might otherwise not interact, economic and financial interactions—these are evidenced by and enabling of these scams, but are also important features and conditions of free and modern societies as we understand them. This is not to say that I am certain that such scams are are an inevitability, and nor do I want to be an apologist for them, but they are tied, it seems, to our (and not just our) social fabric, and attempts at combatting them must keep that in mind.

When I was a child of about 10 or 11 years I received my first chain letter. The previous summer I met S.K. at my brother's day care, which I attended when my mother went back to work, and S.K. and I, in addition to sharing initials, became fast friends. He was in my grade and his sister was my brother's age, though while they lived only two and a half miles away, they attended a local private Christian school. I gave S.K. my address so we could keep in touch, and the first and only letter I received from him was a standard chain letter that described how the letter began, how many times around the world it had gone, and the dire consequences that would befall those who failed to pass it on to five or ten of their friends.

I did not pass it on.

Nothing bad of note befell me, and I like to think of that first instance of refusing to play along as relevant to my life one and then two decades later. S.K. and I fell out of touch, but chain letters continue to circulate, and they, too, made the jump to the internet and email. In all my years online, I have never participated in an online chain latter/email, even those supposedly for a good cause ... no, I will not pass this or that on to five or ten of my friends.

Perhaps I am a grouch, but perhaps chain letters are just the slightly less rational and more benign cousins of pyramid schemes and (internet) scams—benign tumors might not be cancerous, but that does not mean that you encourage them.

—July 6 2006