SPAM in Africa: Problems and Solutions?

Africa, on the Road to Athens, Cairo 18-21 september 2006 SPAM in Africa: Problems and Solutions? Adel GAALOUL, Président Directeur Général Agence Tunisienne d’Internet adel.gaaloul@ati.tn

Summary 1. What is SPAM ? 2. The Spam’s problem 3. The Tunis Agenda and Spam 4. An Approach to Fight Spam

1. What is SPAM? • - Definition: The sending, often massive, of electronic messages not solicited • - Communications : E-mail, Mobile SMS, MMS, Video… • Carried content: Commercial - Offensive and harmful content - Security (Mail Bombing, Viruses, Phishing, Scams , ID Theft…) • - A new ecosystem: Low cost entry, high profit, anonymity, not well organised

2. The SPAM problem The spam is reaching worrying proportions of traffic

2. The Spam problem SPAM source SPAM source (2004)

2. The Spam problem Impact: African costumer suffers more from Spam • Less protected and more vulnerable • Narrow bandwidth available • Productivity reduction • Loss of messages (use of inefficient filtering tools) • Reception of fraudulent contents and security risks • E-marketing and e-news companies are blacklisted • Innovation is killed

2. The Spam problem Challenges for African ISPs • Operation costinflation: - filtering software - bandwidth waste - more server / storage capacity • Security problems: servers attacks, organization • Adequate resources: Need more specialized technicians • Quality of service degradation: Blacklisting of gateways • Unsatisfied costumers

3. The Tunis Agenda and Spam We call upon all stakeholders, to adopt a multi-pronged approach to counter spam that includes, inter alia, consumer and business education; appropriate legislation, law enforcement authorities and tools; the continued development of technical and self regulatory measures; best practices; and international cooperation. Paragraph 41, Tunis Agenda

4. Fighting spam, a multi-dimensional approach C B A D Global cooperation Technical actions Regulation Awareness capacity building Anti-SPAM Action Plan Trust / confidence

A. Regulation system ITU study on anti-spam law covering 58 countries (2005)

A. An efficient regulation framework - Anti-spam law • Enacting a law that balance between regulation and promotion of electronic messaging, and fights spam - Complementary actions • Coordination, regulation and arbitration authority • Implementation mechanisms • Simple mechanisms for complaint deposit and reporting, Online reporting forms

A. An efficient regulation framework Two approaches of the legislation • - Explicit agreement (opt-in): Messages cannot be sent without the preliminary agreement of the recipients (Australia, Belgium, Germany, UK, Italy, France, Switzerland…) • - Assumption of acceptance until refusal (opt-out): • Sending of messages to people who do not oppose to it(Switzerland, Japan, Korea, USA…)

A. An efficient regulation framework Content of legislation • Messages constraints: • Explicit un-subscription must be included • Prohibition to falsify or hides origin and heading informations • Use of special labels to add in the subject for commercial, adult messages (for example ADV…) • Define legitimate mass mailing conditions (newsletter…)

A. An efficient regulation framework Content of legislation • Prohibition and sanction : • Sending, ordering, authorizing or gaining through spam activity • Sale, purchase and use of software for electronic addresses collection • Dictionary attacks and personal dataautomatically generated lists • Illegal accessin order to send messages • Sending spam containing malware, misleading or fraudulent contents,scams, fishing, and other frauds…

B. Technical actions • Infrastructure optimisation and Security • Optimise messaging gateways configuration • Checking of compliance with SMTP protocol RFC 2821… • Restrictions on e-mail address, host name and IP address • Protection against email-bombing and limitation of e-mails flow (email per unit of time, recipients per unit of time, errors…) • Protection against dictionary attacks • Protection of customers infrastructure against e-mail attacks and relaying

B. Technical actions Spam management system • Implementation of International Blacklists (RBL, RHBL) and Setting up National Blacklists • Setting up white lists for mass mailing users and an authentication SMTP gateways • Installation of anti-spam and antivirusfilters at ISP level • Distribution of anti-spam tools for end user (possibly open source) • Setting up tools and methods for spam reporting and collaboration • Staff for managing spam incidents

C. Awareness and capacity building Reinforce awareness and capacity building • Inform and develop understanding of spam, fishing problem, Open relays … • Integrating security modules in children education curriculum for positive use of ICT • Capacity building programs (specialist, business, teacher education …) • Disseminate information via Website: Anti-spam toolkits, training materials…

D. Global cooperation Establishing Anti-spam Taskforce: • Define charters: messaging services use, commercial mailing services and direct marketers • Set up cooperation between ISPs and other stakeholders: anti-spam platforms, experience sharing (blacklisting, white listing, tools…), best practices… • Develop join capacity building program • Set up reaction and emergency plans • Procedure of data and statistic collection

D. Global cooperation Reinforce International cooperation • Many existing frameworks: • APEC Anti-Spam Strategy, London Action Plan • OECD tool kit, ITU activities • Coordinate international cooperation nationally • Need of anti-spam African cooperation (Anti-spam Network)

THANK YOU MERCIشكرا

SPAM in Africa: Problems and Solutions?