Shutting down the bad ISPs

The recent takedown of McColo and two other dodgy ISPs did result in a drop in spam, although by most reports, volume is creeping back up as the spammers find alternative providers. Taking down these ISPs had both a direct and an indirect benefit in terms of fighting back at spammers. Besides depriving them of a spam-friendly provider, the episode also raised awareness on the part of other ISPs, which are now more likely to drop blatant spammers from their service as well lest they suffer the same fate as McColo. As a result, there are fewer spam-friendly ISPs, and in the end, the ISPs that do cater to the bad guys are likely to become more expensive because of greater demand. And so, market forces will work against the spammers (most of which aren’t getting rich anyway) by making it more costly for them to operate.

An opinion on Security Focus delves deeper into the issue of what to do with the ISPs that continue to serve the spam community. Columnist Oliver Day suggests that the takedown strategy that shut down McColo is actually a weak and ineffective system, since law enforcement was not involved in the shutdown; rather, it was carried out as a result of the ISPs ceasing to route traffic for the hosting provider. The ISPs that effectively shut down McColo did so out of self-interest; that is, to preserve their reputation and avoid public backlash. This however is not necessarily a bad thing, if shaming ISPs into doing the right thing works, let’s do it.

Day makes a good point in stating however, that simply relying on “vigilante justice” with regard to spam enablers isn’t enough–although legal actions are very limited in this regard. He suggests that instead of the current model, where each ISP makes its own rules and terms of service, a more cooperative, or “Kantian” model should exist where an international body would set rules of conduct. However, such a model may be impossible to create in reality because there is no central enforcing body. A system of self-regulation may be more practical, and if the industry could get it together, it would go a long way towards setting a uniform standard that would define what an ISP should or should not allow in terms of spam.

But at the same time, that “vigilante justice” deals with spam with a heavy hand, which is what is needed. In fact, this type of justice is nothing more than consumer reaction and market realities, and is no different from product boycotts and the like, which reflect what the public is willing, or not willing, to put up with.