Logging 'subject' field of detected Spam?

[Quentin Campbell]

Julian

In the UK the "Subject" line is considered to be "content" so logging it
would be "interception" under RIPA. Whether such interception by
MailScanner is lawful would depend on the circumstances.

Note that the above applies even more obviously to quarantining of
messages and sites in the UK who do this need to be very clear about the
how and the why. Even if the quarantining/interception is lawful the
site may still be open to civil suit by their users if they are not
careful.

I note that the "Subject" line is present in the "virus warning"
messages I receive as Postmaster so I may already be operating in breach
of the law! However I think this is covered by the Lawful Business
Practices Regulations and/or by the provisions in RIPA covering
interception for the purposes of ensuring the correct operation of a
service.

Sigh! 

Quentin
---
PHONE: +44 191 222 8209    Computing Service, University of Newcastle
FAX:   +44 191 222 8765    Newcastle upon Tyne, United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

> -----Original Message-----
> From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK] 
> Sent: 12 March 2003 18:23
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Logging 'subject' field of detected Spam?
> 
> 
> Would this be used by other people as well? It would generate 
> considerably more logging output.
> 
> The code is is Message.pm around line 343, shouldn't be 
> difficult to add but would require yet another configuration 
> option "Log Spam Subject" to switch it on and off.
> 
> At 17:54 12/03/2003, you wrote:
> >Hello all...
> >
> >I haven't looked at the code yet, but was wondering
> >how tricky this would be to implement...
> >
> >Now and again I try to add variations of 'known' spam 
> 'Subjects' (and 
> >some body content) to my MTA configuration to block it...
> >
> >Is it possible to add logging of 'Subject' to the line:
> >
> >Mar 12 17:25:06 hancock MailScanner[30443]: Message B1F1C15600B from 
> >193.63.251.18
> >(anstpbat at icecube.lshtm.ac.uk) to lshtm.ac.uk is spam, SpamAssassin 
> >(score=13.5, required 8, DATE_IN_PAST_12_24, DCC_CHECK, 
> >DRASTIC_REDUCED, HOME_EMPLOYMENT,
> >  INVALID_DATE, INVALID_MSGID, NO_REAL_NAME, ONCE_IN_LIFETIME,  
> >RAZOR2_CHECK, RCVD _IN_OSIRUSOFT_COM, REMOVE_SUBJ, UNDISC_RECIPS)
> >
> >... or as an additional line after that?
> >
> >...
> >
> >
> >
> >-------------------------------------------------------------
> -------------------------------------->
> >Peter Bates, Systems Support Officer, Network Support Team. London 
> >School of Hygiene & Tropical Medicine. Telephone:0207-958 
> 8353 / Fax: 
> >0207- 636 9838
> 
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz 
> MailScanner thanks transtec Computers for their support
>