Schneier on Security

Davi Ottenheimer • June 16, 2008 11:50 AM

“Who the HELL actually buys drugs advertised in spam?”

The bigger and more important question is who actually buys drugs advertised, full stop? Or in other words, who thinks unsolicited advertising is a good idea?

Believe it or not there are many marketing executives who are jealous of anyone who can move product using any means possible. They honestly can not give you a clear definition of spam because they see marketing as marketing no matter what the medium.

I have sat in many meetings with marketing execs who say security is silly for thinking consumers hate unsolicited mail. “How do they know until they see” was sometimes the refrain. This is the often awkward and unstated role of an information security professional, to help define digital ethics and even to try and create the line between consent and fraud. The line is easier to hold, of course, if there is an independent governing body involved.

Perhaps my most ironic memory of this was when a team I managed had to respond to a spam-originated incident on a marketing system, and yet that same day we could not convince them to change their outbound email messaging campaigns.

All too often in incidents you will find people saying “don’t point that finger over here, we meant no harm with our x”. I guarantee there are marketing execs right now trying to figure out how to harness botnets for their “legitimate” advertising campaigns.

I noticed the BBC was recently poking fun of drug marketing in America:

http://davi.poetry.org/blog/?p=1564

“Americans do accept advertising in areas where it does not tend to appear elsewhere.”