Blue Frog Anti-Spam Initiative, Part I: Good Aspects

Bringing Spammers to Their Knees
Tom Spring, PC World
Monday, July 18, 2005

In a novel if potentially controversial effort to fight spam, a firm called Blue Security this week begins distributing the beta of a free program that, once installed on your PC, makes it part of a community that works to cripple Web sites run by spammers. [Full story]

This article reports a controversy around Blue Frog, an anti-spam program just released by Blue Security. Users install it on their computers and put their email addresses on a Do-Not-Intrude Registry. When a spammer hits one of the company's spam traps or any inbox listed in the registry, every listed user's computer sends a complaint to the offending website, potentially crashing it. While the program may be effective, I see some shortcomings in its rationale, methods, and legality.

While there are some benefits I can see to parts of this program, it seems to me that this development is frightening or wrong on several levels.


There are some positive aspects of the Blue Frog system:

*CAN-SPAM analysis

Blue Frog analyzes the spam... and identifies messages that are not compliant with the federal Controlling the Assault of Non-Solicited Pornography and Marketing Act (known as CAN-SPAM). These include unsolicited marketing messages that don't provide an opt-out option or that have an invalid return address.

*Auto-warn

Blue Security says it will attempt to warn noncompliant spammers to stop sending e-mail...

*Fair warning

Blue Security says... it will do everything it can to contact the people who send out the spam and... the Web sites those messages link to... If that doesn't work, Blue Security will attempt to contact the Internet service provider hosting the site...

In and of themselves, these three countermeasures could be a helpful, effective timesaver to complain to spammers and ISPs about unlawful business practices. This would save people the trouble of manually replying to every letter and notifying the proper authorities.


*Human spam checks

Once spam messages are received at Blue Security’s Operations Center they are analyzed by the Blue Security analysis team to identify the violators.... [1, p. 5]

The fact that checks are made for legal violations by people instead of computers greatly decreases the chance that a legitimate business will be wrongfully attacked.


Coming up: What's wrong with this approach?

Reference:
[1] BlueSecurity - Active Deterrence Technology (PDF)