Thank you, Mr. Chairman. Bonjour and good morning.
My name is Chris Lewis. I'm the chief scientist at Spamhaus Technology, which is part of Spamhaus, one of the largest and most well-respected sources of Internet threat intelligence in the world. While most of you may not have heard of us, more than half of the Internet is using our data in one way or another, whether it's branded as Spamhaus or not.
Unlike most of the people speaking to you on the subject of Canadian spam, I work deep inside the technology itself. To me, this is a 24-7 effort, and with the technology we use, I am seeing on the order of 750 million to a billion email spams a day through systems I administer to try to analyze what's going on and come up with solutions to stop it.
I worked in Ottawa first as senior security architect for Bell Northern Research, which later of course became Nortel, from 1991 through to 2012. I've been working on spam in one way or another since about 1993. By the time the 1997-1998 time frame rolled around, it became obvious that email was the battlefront that needed to be saved for the Internet to prosper and email to continue.
Since that time, I have focused primarily on spam, malware, and botnets, as opposed to the deliberate sending of email that did not have permission, but specifically on the technical side of stopping some of this. In 2003, I developed a new technology that greatly increased the effectiveness of our filtering at Nortel, which required vast amounts of data from all over the Internet. I would analyze this data coming in from partners and people who contributed this data, turn it around, and give it back to the Internet for free. That's how that continued for many years. Then late in 2012, Nortel downsized to the point where they no longer needed me to run a mail server for 50 people, and so I transferred to Spamhaus the next day.
I am one of the founding members of the Coalition Against Unsolicited Commercial Email, CAUCE. I have been invited to speak at the Federal Trade Commission spam panel; advised on the U.S. CAN-SPAM Act, am a founding member of the NCFTA- FBI Project SLAM-Spam; won an award from the FBI for my efforts in helping secure U.S. government networks; was invited to be a senior technical adviser for the Messaging, Malware and Mobile Anti-Abuse Working Group, or M3AAWG; belong to many technical working groups targeting specific spam and malware; have trained and assisted with many law enforcement regulatory groups around the world, including the CRTC and organizations in the Netherlands, Australia, the United States, and many other countries; and am a member of the London Action Plan, which is now called UCENet. Don't ask me what that means, because I've forgotten.
Currently Spamhaus is supplying to Public Safety's CCIRC, free of charge, a very large dataset of spam attacking Canadian email addresses, which they use for a number of purposes, including prosecutions through the RCMP and the CRTC. They're also using it as a way of alerting Canadians to infections of their systems, and they periodically give out reports telling providers, and in some cases individuals, that they have been infected with something and how to resolve it.
I'm speaking here primarily on spam, though other forms of online abuse are just as big, if not bigger, and more dire. The malware fraud and phishing scenario, as has already been somewhat alluded to before, is as big a problem, and they're all getting worse.
Of particular interest here is that much of my time as an adviser to M3AAWG was spent with the email sender community—with Inbox Marketing, and so on—helping to come up with best current practices on how to manage subscriber lists, when you have permission and when you do not, and I was heavily involved in drafting part of the M3AAWG sender best common practices, BCPs, which are still being updated and published. The BCPs are considered to be one of the industry's most important set of guidelines that most of the large sender community is already complying with. In fact, a sender organization can't be a member of M3AAWG unless they comply with it.
It raises the question that if most of the industry is complying with the M3AAWG BCPs—which to a very real extent are mapped directly on CASL, with the very same principles and the very same things—why is there such a concern about compliance?
I'm going to go on to some specific facts and details from the last few years.
We operate email sensors that monitor, in one sense or another, billions of emails per day via arrangements with providers. We also run our own infrastructure to receive email that is being sent to people who no longer exist on the Internet. A particularly good example is some email addresses that were at Nortel many years ago. Public Safety's CCIRC now owns those domains, and they have asked us to operate them as if there were still a user base there. We can see what spam comes out, see where it's coming from, identify correlations, and publish information to our customers—in many cases for free—on how providers and so on can protect their users from this stuff.
Over the past seven years, there was a peak in 2011 of 10 billion spams per month, with peaks to 750 million per day on our own servers. This was not the big cloud of contributed data, but the stuff we run ourselves. Most of this was the Rustock botnet, which was infamous for high volume, with fake pills and fake brand name watches. The latter is just fraud, but the first one is dangerous, because many of these pills were analyzed by people we know in the industry and found to contain, literally, street sweepings and so on. Whatever they could squeeze together and dye blue, they would sell.
For a few years after that, the volume averaged around three billion spams per month, because the Rustock botnet was taken down by efforts from a number of organizations on the Internet, as well as the FBI. Over the past year, the volume has climbed almost all the way back up to 10 billion per month. Instead of fake pills and watches, it's ransomware from the Necurs botnet and Russian dating spam. Also from the Necurs botnet, which is even more disturbing, is the ransomware we hear about on the news, the type that encrypt hospitals' entire datasets so that they cannot get them back or have to spend an enormous amount of money to get them back.
Still, within those enormous volumes of that sort of dangerous material, there are very high volumes of affiliate spam advertising legitimate, semi-legitimate, and outright fraudulent companies and products from people who have no concept of privacy—those who hire hackers to steal and provide them with email addresses, phishing, and so on.
Industry leaders such as SenderBase Talos, which is actually part of Cisco, have long been sources of reliable, “on the wire”, real statistics, and they generally tend to agree with our numbers. We don't expect them to agree exactly, because everybody's spam sample is different—it is surprising how differently it can vary from one place to another—but the trends, spikes, and everything else, we coincide with exactly.
I've had the opportunity to monitor the volume of email and spam received by some of Nortel's old domains for almost 20 years. I built and ran the mail servers that handled them when they were in service and for the 18 years they have been defunct. As I mentioned earlier, those domains are now owned by CCIRC as a national threat resource, and they have requested that we operate those domains for them.
By 1997, Nortel decommissioned these domains and moved all users to the main email domain that Nortel was using at the time. In 1997, there were three million emails per month, of which 40% were spam; by 2001 there were four million, all of which were spam; by 2003 there were seven million spam messages, and by April 2016 there were 150 million. Today it is 350 million per month. This is a 350-fold increase over 20 years.
You're asking yourself, “Did my spam volume go up by that much?” No, it hasn't, but it is only because of efforts by your ISPs and organizations such as ours that it has lessened.
The volumes keep growing. Spammers game our systems, and it's very difficult to continue.
I'm being waved at, so I'm going to cut this a little short.
One of the issues with CASL is the private right of action. One of the things we want to be able to deal with is a situation of individuals getting very high volumes. An associate of mine had an email domain for himself and his wife, and one day it started receiving a million email spams a day. We don't know why. I have some suspicions, but we have no solid information as to why that happened. The volume was so high that he couldn't even run his own server anymore, because it was costing too much. PRA gives him a chance to deal with this.
To finalize, spam is not a technical problem but a human problem, and it has to be dealt with from both aspects.
