20 Years Later....

In heady days of the mid-to-late nineties, the web was fresh and so was the spam. It was the era of Lycos, Napster and MetaCrawler - Google had barely been incorporated, Palm was making smart phones and Apple were making blue plastic TV paperweights.

During such heady days of technological marvel I signed up a for hotmail.co.uk email address - one I've been using ever since. Of course, in the [web] medieval days spam was in a different order to today: the economies surrounding ads and direct marketing was dramatically smaller, and simple junk mail rules were sufficient.

Today though things are different. Data slurping fisheries such as TeraData scrape personal data from jobs boards, people still believe online surveys and prize giveaways are actually rewarding, and companies bitter at receiving SARs and ICO complaints never used to sell your data on.

As a result the majority of traffic on my Microsoft accounts are ads, phishing attempts or newsletters I didn't subscribe to. Thanks to Microsoft - since getting shot of Balmer they've come such a long way - its easy to get shot of all this spam in one go.

Last month I added a new alias to use for my core MS services and set it as the primary alias. Aside from a couple of complications with the Xbox Insider Program and Amazons Xbox app authentication it was smooth sailing. I had to notify one organisation of an email address change - that's it. Android apps related to the account all seem to have switched themselves over.

This is no mean feat considering the authentication model, security and architecture involved with multiple devices (phones, consoles, laptops, desktops) happened seamlessly and without support intervention.

So today, with little or no incident logged as a result - an achievement in itself - I'm deleting the now unused hotmail.co.uk alias. Perhaps that will trigger an avalanche of account issues, but if there are no more posts from me on the subject over the next few weeks, assume all went well.

[Updated August 2017 - All went well, the rate of spam to my Hotmail Outlook.com addresses dropped like a stone]

From a humanist perspective I feel like departing from the Hotmail domain and fully accepting the Outlook.com moniker is saying goodbye to the old family home in a lot of ways. The email address, for me at least, dates back to essentially the beginning of the web (which evokes nostalgic thought of AOL, university HP-UX lab time, Half-Life and Team Fortress lan parties) I've no doubt there are probably still hundreds of thousands of people - perhaps millions - still using hotmail email addresses via Outlook.com, however it does feel like the personal loss of a battle in the war on spam.

I still get around 400 spam emails per month on the personal email addresses (excluding this hotmail address) I regularly use - a substantial increase from non-EEA countries of origin - the problem is far from over. But this set of spam arrives on domains and servers I control, which means the senders cannot hide. The usual jokers who begrudgingly respond to SARs and then add that email address to whatever spam subscriptions they can find basically.

I've been designing a filtering, tracking and reporting system - known only as project RingoDingo for the time being - which I hope to use to map the flow of personal data. It might just make some nice diagrams but could be useful for everyone - based on all the spam I get I'm trying to recycle it for good purpose by using it as test data. One of the primary goals is to deal with spam actors before they get to your door step. At the moment I'm looking to open-source the majority of the modules.

GDPR can't come fast enough and I just don't have time for legal action against spammers at the moment (in the last few years this has been the only effective way to force spammers into respecting the law itself); this is measured against the more recent actions from ICO, which are extremely promising. Recent direct communication I've had with ICO's dedicated anti-spam team also looks very promising and this apparently renewed sense of vigour in their approach is most welcome.

Retaining a more optimistic perspective, we could infer that the data trading and spamming industry will have to remap their entire business model, or face massive financial penalty. I've already seen tweets from DMA-affiliated accounts signal as much. So giving up my hotmail.co.uk email address is a small price to pay.

Last one to leave the domain, please turn off the lights.

Side Effect: Snoopers Charter [Part 4]

It's been a wholly unsurprising journey to the Room of Truth with my CSP, only to be locked out of the final door.

After an online chat I finally got my request through to the legal department, only to be told that because it was a corporate account the DPA does not apply, and also; under Part 4 Section 93 of the IPA the CSP is not allowed to release the ICR data to me.

So I replied and re-iterated that the moment my SAR arrived identifying me, and linking me directly to the ICR data in question - also providing my authority as the account holders director - the DPA does apply as my name is linked to the internet usage [and that as my internet usage may contain specific records] and sensitive personal data.

Section 93 also refers to ensuring that the CSP puts adequate controls in place to retain the data in a secure manner. Nothing to do with disclosure. I can find no provision of the IPA which prevents the disclosure of ICR to the data subject(s) in question.

I'm the middle of designing and developing anti-spam security solution so frankly just don't have the time to focus on this at the moment. Whilst legal opinion appears to be that the IPA is not legal, I doubt the Prime Minister or Home Secretary are willing to have that "grown-up conversation". However ICO has enough of a fight ahead convincing the cabinet that it needs to keep parallel laws to keep trading with Europe.

Time to draw another spidergram and send the details to ICO - I can't imagine that the government regulator will do anything other than side with the government communications provider in this case.

I am Jack's total lack of surprise.