Best of the ISP Lists

What Can ISPs Do About Fraud?

The ISP-Security list discusses overcoming online abuse and crime. Once you know about it, what can you do about it?

[June 8, 2000]

On the ISP-Security list in May, BG wrote:

"I would like to set up some sort of regular contact to overcome fraudulent users and those who migrate from ISP to ISP hacking, spamming, and harassing their way across the net."

One respondent expressed guarded enthusiasm for the idea:

[MS wrote] "Sounds like a good idea. But if such a list were compiled, how would we use it? More than likely the names on such a list are fake, or maybe even 'stolen identities' of innocent individuals. We would need to have a way of 100% verifying that the true culprits are listed. And if we do verify, then what?"

Another respondent pointed out that this was a recurring topic:

[MW wrote] "This subject or something similar comes up on a quarterly basis and gets kicked around ad nauseum. Basically, there's no practical and abuse-proof way to accomplish this."

However, a number of respondents suggested ways of dealing with abuse and fraudulent behavior:

[MC opined] "A simple way to accomplish this would be with a 'black list' database on a Web server. But you would have a hard time controlling abuse from individuals, and also making sure you have the right 'John Doe.'"

[G added] "ISPs have an obligation to enforce their abuse policies, but they can't kick off every user for being rude when it comes to public posting. There are certain limitations on what an ISP can do-there's a degree of free speech on a public forum. I use kill files in some cases, which doesn't always work, but it is very helpful. Ignoring it is just the best thing and does help. If the offended party wants to seek legal action, depending on the ISP's terms of service (TOS) or abuse policies, ISPs should comply and work with legal authorities if it is requested through the proper channels. However, if a user sends harassing emails, the ISP can issue 'cease and desist' emails to that user."

[J suggested] "Have a look at the U.S. Department of Justice's Computer Crime and Intellectual Property Section. If you see users pursuing illegal activity, be pro-active: file charges. Very few ISPs actually want to be proactive, and that is why the level of abuse is so high. But these crimes should be handled as all other crimes should. All ISPs and Internet Sites should create policy statements for employees and visitors, and privacy and security policies. Then we should all implement egress and ingress filtering which eliminate most of the abuses that may be caused by users."

Related Articles

5 Stupid Things ISPs Do to Screw Up Their AUPs

Hack, or Harmless Intrusion? Is running a port scanner on an ISP's network necessarily a prelude to an attack?

Hacked Off What to do if you're hacked?

Can We Win a War on Spam? Can anti-spam laws work?

Canning Spam

Unethical Registrar The ISP-Tech list discusses an ISP that registers clients' sites in its own name, and prevents customers from leaving by holding the domain name hostage.

U.S. Court Declares Domain Names Not Protected

Nonpaying Customers

—End