Account deletion due to mail abuse

Jan 19 06:07 UTC 1997

  There was an announcement in the Agora conference's System Problems
item recently about a user's account being deleted because a lot of
messages were sent from that account.  There was some discussion
inquiring as to why the account was deleted, instead of taking other
measures, and if that's how such situations should be handled in the
future.  This item is intended to continue that discussion.
 
  Here's a recap of explanations from staff of what was done and why:
 
>#113 of 138: by Goddess Of Static Electricity (valerie) on Fri, Jan 17,
>1997 (13:42):
> Re mail problems: We had a user who sent out several thousand e-mail
> messages in the last day or two.  This could explain both slow e-mail
> traffic and slow net-link problems.  The user's account has been deleted.
>
> This probably doesn't explain the lack of mail to/from ford.com, though.
>
>#122 of 138: by Scott Helmke (scott) on Fri, Jan 17, 1997 (19:22):
>
> This was a clear case of vandalism, setting an automated system to send
> thousands of mail messages.
>
>#126 of 138: by Steve Gibbard (scg) on Fri, Jan 17, 1997 (22:53):
> Assuming this was a one shot thing, we could stop the mail from going out
> by just deleting the mail.  The problem that lingers long after the mail
> has been sent, though, is that of mail coming back to the system, either
> from angry people wanting to reply to it, or due to incorrect addressing
> on the mail being sent out.  We don't really care if this user can still
> read mail or not.  Since it appears that the only reason the mail bomb
> was done was as vandalism, probably the user doesn't care either.  What
> we do care about is load on the system.  If the account isn't there, the
> mail will be stopped before it comes over our Internet link, since Grex
> won't accept mail for a user who doesn't exist.

response 2 of 89:

Jan 19 06:16 UTC 1997

The way it's been discussed, it sounds like Valerie deleted an account because
 she didn't like how much mail a user was sending.  There is a *huge*
 difference between that, and deleting an account to stop something that could
 only be seen as malicious, which is what Valerie did.

response 4 of 89:

Jan 19 17:12 UTC 1997

My impression was that the first day the account wasn't deleted and a message
was sent asking them not to do this.  The second day the same person again
sent about a thousand messages, and got nuked.  I'm not sure this is accurate.

response 6 of 89:

Jan 19 21:31 UTC 1997

Valerie didnt say whether this person had been contacted to ask why
they were doing what they were doing.  I believe "newuser" *asks* people
not to run large mailing lists, but it doesnt say "If you run large
mailing lists, your account WILL be deleted"  Some people dont know
policy.  

I dont dispute that the actions taken were necessary, just that policy
that isnt spelled out and mader clear to the users is unethical.  For
instance, I knew someone once who had a falling out with another user, and
that user hacked his password and ran a mailbomb on his account (this was
not on grex, elsewhere where the pw files obviously werent protec ted
well)  HIs login got deleted and it was allhe could do to find out what
happened and prove that it wasnt him.  These thingshappen.

I think the proper policy would have been to freeze his access so when
this user logs on he gets:

"Your account login has been suspended by Grex staff for security
violations.  Please contact staff at (list telephone number) for an
explanation.  Good Bye."

And then log that user off.

This allows the user to make a verbal case for himself, a chance for
redress of grievance.  Even rapists and murderes get to make their case.
Scum who run mailbombs deserve the same opportunity.

response 8 of 89:

Jan 20 02:05 UTC 1997

SCG, that seems to be saying the equivalent of that a person who has jsut
moved into a town doesnt deserve the same chance to defend himself or herself
as someone who has lived in that town all ther lives?

One time, back in college, I created an account ina computer lab and
had my password stolen because someone there saw me write it down.  I
had that account all of six hours.  Did I not deserve the chance to
get it back?  Fortunately noone ran a mailbomb on that account but
even if they had, I still deserved the benefit of the doubt in that I had
created the login legitimately.  Had the person who stole my account run
a mailbomb, I stilll should have had the opportnity to defend myself
before it was assumed I did it and my account deleted.

Like it or not, staff acts as the judiciary here.  I think it is a bad
precedent if new logins arent given the same presumptions of legitimacy as
any other accounts.  Even if this guy was scum, he should have had the
chance to respond before staff "executed" his login.

response 10 of 89:

Jan 20 02:17 UTC 1997

There's a difference between just moving into town and moving into town and
then immediately sending junk mail to everybody else in town, and the next
town over as well.

response 12 of 89:

Jan 20 06:27 UTC 1997

  This Rob?  I don't have a particular interest in this, I just entered
the item since it was overtaking the System Problems item, and I think
co-op is the more appropriate place to discuss it.
 
  After hearing the details, I dunno, if the person was sending e-mail
to different addresses on the same system, it doesn't sound to me like
the person was doing it maliciously, they were doing it cluelessly,
which I think makes a big difference.  But whether messages went to
different address or not isn't specified in #11.  I definitely disagree
with STeve that *anybody* sending thousands of messages knows it's
wrong.
 
  -Rob

response 14 of 89:

Jan 20 16:21 UTC 1997

Excellent work, Valerie!  You did just the right thing, especially
with *two* mass mailings in two days.

response 16 of 89:

Jan 20 17:32 UTC 1997

The newuser text should talk about what grex is, though.

response 18 of 89:

Jan 20 19:21 UTC 1997

I don't really have much patience for people like this.  The guy brought Grex
to it knees twice, impacting hundreds of other users, plus spammed mail all
over some hapless system elsewhere.  Sure, its nice if we can figure out
whether he is an asshole or just stupid, and try to apply appropriate
corrections, but the highest priority is to MAKE HIM STOP.  Staff doesn't
always have limitless time, so we sometimes have to prioritize.

response 20 of 89:

Jan 20 21:54 UTC 1997

I don't know how to do that.  I think it would require modifications to the
mail transport software to be able to turn off a person's ability to send
mail.

response 22 of 89:

Jan 20 21:58 UTC 1997

Jan slipped in...

response 24 of 89:

Jan 20 22:56 UTC 1997

Why not write these unqrittenrules down so people can know what
they are.  Unwrittenor unstatedpolicies wil always cause confusion when they
are acted upon.

Andhow are new staffers supposed to know allt he Un written policies.
A little "staff handbook" couldbe developed and would be a good idea.