blog.anta.net

Anti-abuse jargon knows a term by the name of mainsleaze – reputable, mainstream companies who resort to sending or supporting unsolicited promotional email. I don’t get a lot of mail sent by or for such companies, but a few days ago, I received another unwanted message from an outfit by the name of Penton. (According to Penton’s web site, they rent out a list of “over six million potential buyers”.)

I vaguely remember having done something that, as an adverse effect, landed me on their list. However, I also know I have requested removal at least twice - I have sent one removal request to sharon@windowsitpro.com on 8 Aug 2007, and another to subs@windowsitpro.com on 31 Aug 2007. Under almost every telemarketing statute or similar norm I am aware of, a person has the right to be removed from a bulk mailing list, even if he had opted in at some earlier occasion. One example is Finland’s act on the protection of privacy in electronic communications (516/2004), section 26.

Since opt-out requests clearly didn’t cut it, abuse complaints were now in order. I sent one copy to abuse@schlund.de, because the message arrived from a Schlund + Partner AG network, and also advertises a web page on such a network. Another copy went to abuse@maximumasp.com, as the HTML message tried to load images from a web server on a MaximumASP network. I’m not very interested in MaximumASP though, and as for Schlund, a simple web search will show the reputation they have to live up to.

What I do care about is Microsoft, whose products I use and recommend, apparently also participating in a junk mail scheme. This is why I sent a copy of the complaint to Microsoft as well.

• The message was an advertisement for Microsoft’s TechEd IT Forum, “Microsoft’s premier European infrastructure conference”.
• The advertised web URI (http://www.campaigndb1.co.uk/CT00132605MzE5NjUA.HTML, on the MaximumASP network) was a redirect to Microsoft’s TechEd IT Forum site (although the URI contains a string that looks like a way to also confirm me as an active recipient).
• The message also loaded images directly from a web server on a Microsoft network.

Since I had only Cc:d Microsoft, I didn’t expect them to reply. They did though. In that case, one would think that either

1. the unsolicited commercial email message was sent on behalf of Microsoft, in which case Microsoft would take appropriate action against the sender for not honoring my repeated removal requests, or
2. the message was not sent on Microsoft’s behalf, in which case Microsoft would take appropriate action against the sender in order to protect their intellectual property and their reputation.

In reality, Microsoft’s responses have left a lot - in fact, most - to be desired. As you can see, the first reply to the report I had sent to abuse@microsoft.com included this amusing request for additional information:

We cannot fully understand your message. In order to assist you, we need further information.

Please restate and clarify your message with the following information, to analyze and understand your issue in a better way:

• Complete description of the issue you are facing:
• Version and Edition of Microsoft product you are facing this issue with (Example: Outlook Express 6):
• Name and version of the Microsoft product you are referring to (Example: Windows XP or Windows Vista):
• Are you referring to any third-party product?
• Exact error message (if any):

I don’t think my report was ambiguous in any way, especially since my own recommendations on how to file abuse reports have earned certain popularity. I cannot see how the people at abuse@microsoft.com could honestly have assumed the message to be anything else than an abuse report.

Anyway, I gave them the benefit of doubt, and wrote back stating that their web site was referenced in an unsolicited promotional email message I had received, and that I wanted appropriate action in order to have Penton cease sending me unsolicited commercial email (on, as I assume, the behalf of Microsoft). The response from Microsoft was again bleak – among other things, they basically told me to just hit delete:

Thor, if you are receiving unwanted e-mail (sic) messages, you may consider using an e-mail (sic) filter or spam reporting service. Information on spam is found at the following Web sites: http://www.abuse.net http://spam.abuse.ne (sic)

I have now once more explained to abuse@microsoft.com that I want them to either make Penton stop sending me mail, or state that they have nothing to do with the campaign. I’ll probably receive another useless reply written in feigned ignorance… well, at least it might again be something to write about.

At least for the time being, I have no choice but to suspect Microsoft of supporting an abusive bulk mailing outfit. - What do you think? Please leave your comments!

Update 23 Sep 2007: “Hoax”, says Microsoft

The newest reply from Microsoft is inferring that the junk message would have been a forgery:

Thor, you can also report this to the Federal Trade Commission (FTC) or Internet Crime Complaint Center (IC3). These authorities take legal action against senders of deceptive or fraudulent bulk e-mail (sic).

I am surprised at these news, but I will consider reporting the message as per Microsoft’s advice.

While I was typing this update, another message from Microsoft arrived. This one also suggests that the original message would have been falsified:

For information about this and other hoaxes, visit the following Web sites:

• http://hoaxbusters.ciac.org/ (CIAC is the Computer Incident Advisory Capability, a United States Government organization.)
• http://www.snopes.com
• http://www.f-secure.com/virus-info/hoax/
• http://www.symantec.com/avcenter/hoax.html

However, I’m not convinced.

1. Having read a large number of phish and other fraudulent messages, I have a gut feeling that this is not one of them.
2. If I remember correctly, I initially consented to the list at some Microsoft event, or in connection to some communication from Microsoft.
3. The www.microsoft.com web site appears to make almost 200 references to Penton.

Update 2 Dec 2007: The garbage keeps coming

Nothing seems to have changed since I wrote the previous update. Penton keeps sending me their junk mail, and I keep complaining about it.

It’s safe to say that this invasion of privacy has affected how I feel about Microsoft.