Welcome to our security page.

You might find some of the information here rather disturbing. You should do. You will probably find some of it a little difficult to believe. If you do, remember that you shouldn't believe everything that you read on the Internet, because frankly a lot of it is nonsense. But also remember that it is easy to check facts using your favourite search engine and some common sense. Of the information here that you should be concerned about, there isn't much that can't be checked in that way.

Some of the information here is a little technical. There are links from many of the technical terms used here to articles on respectable sites like Wikipedia so that you can read more about them if you feel that it will help you understand the issues. But you don't really need to understand the techno-babble unless you want to run your own Internet service. If, for example, you're just trying to find out why your mail to us hasn't been received you can skip most of the technicalities. But please do take the time to read through the less technical parts. Hopefully you might then be persuaded that we're doing our best to help you. You might even want to let your ISP (or your bank!) have a link to this page.

Bottom line:

Background.

Computers, and particularly electronic mail, are mixed blessings. They can be a great asset, but they can be a royal pain.

The criminal problem is very real.

But it's not all bad. We are very grateful to Lloyds Bank, who happily credited a cheque for about 3,500 pounds to Jubilee's bank account despite our telling them that it was obviously stolen. After the owner of the stolen cheque book got in touch we checked that Lloyds had reimbursed her, then asked for an apology from the manager. None was forthcoming. We held onto Lloyds' money for about a year, then gave it back.
(Actually it was the author's sister who gave it back. If the author had had his way, either we'd have had that apology or we'd still have the money.)

The weaknesses.

Some of the weaknesses inherent in the ways that the Internet is used are laughably simple.

However, many of the weaknesses are far more insidious and difficult to deal with.

In the main, the networks and their underpinning protocols were totally inadequate to deal with the non-technical problems which very rapidly appeared. In 2012 most of them remain so, largely because of the tremendous inertia in the global Internet infrastructure. Large sections of the Internet have been hijacked and are now used by criminals. Founded on the failings of the computer networks, plus ignorance and fear, an entire industry has boomed.

Progress is being made slowly in certain areas, as you will see below.
But as usual, progress brings with it a few problems.
We'll touch on those too, because they directly affect both us and our customers.

The attackers.

Criminals often use computers far more than the rest of us. It is not unusual for an Internet criminal to send hundreds of millions of fraudulent email messages every day. They often do this using botnets.

Just to be clear, the criminal problem on the Internet has long since moved on from naughty schoolboys writing rude words up the sides of skyscrapers. The Internet is now the target of serious organized crime, and the criminals make billions from plying their trade. If you presented a significant threat to their enterprise, some of these people wouldn't hesitate to have you killed.

Attacks on our computer systems.

Jubilee provides Internet and other computing services to customers, and also runs its its own Web and electronic mail services. We've been doing that kind of thing for nearly three decades. Every criminal on the planet who wants our email address has it by now. And although most of them seem by now to have given up on trying to steal our computer resources, every one of them still seems to be trying to send email to us, apparently every day.

Incidentally, let's not forget that sometimes mistakes happen. Once upon a time, long ago, one of our customers tried to send a video to another one of our customers by electronic mail. Unfortunately, the video was rather large, as electronic mail messages go. It was about ten Megabytes. It wasn't even a good video. Some spoof about an Orca eating a guy in a canoe. Still more unfortunately, the software which they were using to try to send the message was produced by Microsoft and it didn't work very well with large messages. We found out about this several days later when the poor unsuspecting recipient had received his ten thousandth copy of the ten Megabyte video and was, by now, desperate for help. So we've taken precautions to try to prevent a repetition of this kind of thing. In this case it was a genuine accident, but this kind of thing is often done deliberately.

The defences.

Naturally it would be unwise to publish the full details of all the security measures which we have in place, but a small selection is mentioned below to give you an idea of the sort of thing we do.

We employ a number of different types of defence to prevent criminals from

When criminals come up against our defences, most of the time they go elsewhere to look for a softer target. But sometimes they try to find new ways around them. That means it's a never-ending battle. We have to work constantly to stay ahead of the game, so that we can continue to use our resources for our own benefit and for the benefit of our customers.

Defending you.

1. When you use your computer to go to an Internet banking site, how do you know it's the real site that you're visiting?

Short answer: You don't. You just hope it is.

The way that Internet sites are looked up in the world-wide directory that we call the "Domain Name System" (DNS) has never been secure, but that is slowly changing. Jubilee is at the forefront of these changes in that we provide cryptographically verifiable, signed DNS records for our public Internet resources. This is called "DNSSEC". The technology has been available for over a decade, but, even in 2012, very few businesses with an Internet presence use it. Jubilee really is amongst the first. Your bank, for example, probably doesn't use it yet. This is mentioned here because, rather than being a measure designed to protect us from criminals, it is one designed to help you to protect yourselves from them. Your software needs to be very up-to-date (even in 2012) to take advantage of it.

Unfortunately these new, signed DNS records are much larger than the old, unsigned versions. There's really no way around that. And there's a lot of very old and buggy software out there on the Internet, and some of it is not capable of understanding (or sometimes even of transporting!) signed DNS records. This can cause problems. There's nothing we can do about that except to tell you that your ISP (or your bank) for example may be using old and buggy software, and suggest that you ask them what they're going to do about it. In time, everyone else on the Internet will catch up and these problems will go away. But until then, sometimes your ISP's mail systems will not be able to find where to send mail for us, either because it does not understand our signed DNS records, or because it cannot find them. We apologize for the inconvenience.

2. We publish Sender Policy Framework (SPF) records so that you (or, more likely, your ISP) can tell the difference between mail which is genuinely from us and mail which is forged to appear to come from us. This is another technique to help you to protect yourselves, and it is, unfortunately, widely misunderstood. Many ISPs, even some very large ones, use it incorrectly. Luckily, unlike the problems with signed DNS records, we can take steps to mitigate some of the problems caused by incorrect SPF usage -- if we are alerted to them. But there's still very little that we can do about buggy third-party software, and if your ISP misinterprets our correct SPF records, there's not much that we can do about that either.

3. We scan all our outgoing mail for undesirable content. More details of the scanning are given below, but we mention this now as it's another key ingredient in protecting you. We don't expect ever to have a virus problem (more on that later too) but it makes sense to scan outgoing mail just in case one day we are taken by surprise.

4. We do not under any circumstances serve any kind of content from third party Web servers. If you want to know just how embarrassing this sort of thing can be, read about the London Stock Exchange.

Everything that we serve to you is our responsibility. We serve no

Defending ourselves.

5. An important defence against criminals is commonly called 'Linux'. The meaning of Linux is very widely misunderstood, but we don't need to dwell on that. The main thing to note here is that we use no 'Windows' systems, which means our systems are very much more reliable and more resilient against attack than they would be otherwise. To be fair, that's partly because criminals put a lot more effort into developing methods of breaking into Windows systems than they do into developing methods which could be used to attack other systems.
There are three main reasons for that:

6. Our firewalls record all attempts to gain illegal access to our computers, and many a happy hour is spent toiling over the firewall logs looking for new (and sometimes even interesting!) attack techniques.

7. Our systems are capable of finding the geographic location of the source of any contact from the Internet. Most contact from Africa, Asia, Eastern Europe and South America is rejected. This is because we have found unfortunately that 100% of attempts to contact us from those areas are from criminals. A number of individual countries are also blacklisted as they are constant sources of spam; or attempts to gain illegal access to our systems, or to do damage to them; or all of the above.

8. To assess the probability that incoming mail is malicious, we use third-party services provided by for example

These services are not infallible, and they are not static. Their lists of known sources of malicious mail are constantly changing. That means that it is not possible to know in advance if any particular attempt to send mail to us will succeed. It is simply not possible to know in advance if a computer which is now attempting to send a message is being used by criminals.

9. We use a variety of techniques to scan incoming mail for malicious content such as

When malicious mail is detected, the address of the computer attempting to send it is automatically added to our blacklists. If your ISP happens to be sharing that computer between you and the criminals, unfortunately your mail is likely to be blocked too. Again, the software which does this work is not infallible and occasionally an address will be added to the blacklist when it should not be. Finding out when and why this has happened is one of the joys of running a mail service.

10. Mail from sources unknown to us is delayed by a certain time so that if for example it turns out to be a 'mail bomb' we have a chance to do something about it before it goes off and causes damage. Obviously we aren't going to tell you how long the delay might be.

11. We do not normally accept mail from 'dynamic' IP addresses, that is the kind of IP address commonly used by ADSL subscribers. If you wish to send mail to us directly from your ADSL connection, without using one of your ISP's mail servers, please contact us.

12. We do not use third parties to send mail on our behalf. If any third party claims to be sending mail on our behalf, they are lying. Our published and cryptographically signed SPF records are the definitive source of information about the IP addresses permitted to send our mail.

13. We use spam traps to counter automated email address harvesting by 'bots'.

The results

Many Internet Service Providers have very large numbers of customers. That means that they have large numbers of customers whose computers have been hijacked by criminals. That in turn means that, at any one time, many of the ISP's servers are likely to be sending out malicious mail. When that malicious mail eventually gains the attention of one of the service providers which we use to block it, then the ISP's servers will be given short shrift by our servers, and all mail from it will be rejected. The idea is that the ISPs may eventually be persuaded that it's worth their while to do something about the problems that they're causing for the rest of us. So far it isn't really working very well (as long as they're making some money, most ISPs don't seem to care) but we live in hope.

If you are in China and you try to gain illegal access to our systems you will most likely be disappointed. If you are in England and your ISP tries to send your mail to us from a server in Italy (more common than you might think) then you might also be disappointed. However, when we know the details we can do something about it. The devil is in the detail, unfortunately.

Whenever one of our mail servers rejects any mail message it does so according to the current Internet standards. That means it replies to the sendng server with a code, plus a short message which explains why the message was rejected.
The sender's ISP is supposed to pass that message back to him, but many don't. ISPs do not want to have to deal with large numbers of queries about the non-delivery of electronic mail. So when Jubilee's mail servers give their explanation about why your mail message was not accepted, most of the time, instead of passing that message on to you, your ISP will simply throw it away. There's nothing we can do about that except to tell you that instead of delivering it to you, quite likely your ISP routinely throws away mail addressed to you.

If your ISP is using old or buggy software which cannot cope with our signed DNS records (this includes many apparently recent firewall products), then your ISPs servers may not be able to find our mail servers. As a result your mail may simply be discarded by your ISP; you may never know that we have not received it, and we may never know that you have tried to send mail to us.

If you are having trouble sending mail to us, by all means let us know, for example by telephone or fax. We will want to know a few details. Unfortunately finding those details is not always easy. Here is what we need:

Bear in mind that some mail services sometimes queue mail in batches for quite a long time (hours in some cases) and sometimes things like hardware faults and network problems can cause mail to queue for days.

There is no way reliably to know whether any given email message has been received. The Internet protocols were not designed to provide such a facility. Some mail clients allow their users to acknowledge incoming messages automatically, but these features are considered by many to be risky at best, because they can confirm to a spammer that he has a good address (which he will then sell).

Colophon.

There's no getting away from it, some of the things that criminals do to try to avoid legitimate employment are very creative. Quite likely, many of the people reading this will be the criminals who give the author so much grief.

The author's message to them is simply this:

If you used your creative energies for something honest, we would all be much better off.

Footnotes:

(*) Many computers have their time zone set up incorrectly, for example many Windows machines in Britain are set to Pacific Time instead of either to British Summer Time or to Greenwich Mean time. Not only does this frequently cause difficulty in establishing exactly when a mail was sent, but it also makes it more likely that mail from that computer will be rejected. Our spam 'scoring' system knows if the time zone on the sending computer is wrong, and an incorrect time zone on the sending computer scores heavily against the message. On a brighter note, by the time message has reached the stage where it is subject to spam scoring, at least we will know where it came from.

(**) Private correspondence.