Re: Spam getting out of hands

Replies:

Parents:

Hugo Haas wrote:

> * Hugo Haas <[email protected]> [2002-04-03 11:10-0500]
>
>>I am thinking of doing the following:
>>
> [..]
>
>>- sue, or otherwise annoy (calling the CEO, etc), the spammers who
>>  will use my identity. I am not sure how to do that though and how
>>  successful I will be.
>>
>
> Since a fake email from Danbri just get through my whitelist, I just
> called them (407-539-0615) to complain about them taking people's
> identity.
>
> Their answer was that I didn't know what I was talking about, that I
> should get a clue and then they hung up on me...


I called the number to find out more. I just hung up from a
fascinating 45-minute call with a very helpful person.

The "good news" is that the guy I talked to said he would have
w3.org removedfrom their database.

Q: Is this illegal?

A: He didn't think so, at least in the US.
   Here's one case in the state of New York where an affiliate
   of the company who sent the spam sued an ISP because the ISP
   wanted to terminate their contract. The ISP lost; see [1].

   [1] http://www.computertimes.com/jul01internetnews.htm#newyork

   More info about the case:
     http://litigation.paetec.net/casedocs.html

Q: Isn't this unethical?

A: The gentleman I spoke to clearly didn't
   think it was, stating that he has the right to knock on my
   door and I have the right to turn him away.

   I didn't purse the ethical issues because their attitude
   was "As long as it's legal and we can make money doing it
   and someone else is going to do this, we're not going to
   worry about ethics."

Q: What can I do about this?

A:

   - The "nice" spammers will remove you from their lists; it's
     not in their business interest to sell lists of email
     addresses of people who don't want spam.

   - Filter what you can and delete the rest.

   - In the future, companies will exchange remove lists and
     spam will go down.

Q: How do you do this?

A:

 - We figure out what version of procmail you're using and
   that tells us, for example, that your mail server will
   accept mail from within the same domain (or forged to
   look that way).

 - We get email addresses by using binomial combinatorials,
   figuring out which email addresses are recognized, and
   then tucking them away for later.

This company makes 3.6 million dollars/year doing this
and they are not going to stop any time soon.

 - Ian
--
Ian Jacobs ([email protected])   http://www.w3.org/People/Jacobs
Tel:                     +1 718 260-9447

Re: Spam getting out of hands

Replies:

Parents:

On Wednesday 03 April 2002 12:21, Ian B. Jacobs wrote:
> Q: Is this illegal?
>
> A: He didn't think so, at least in the US.
>     Here's one case in the state of New York where an affiliate
>     of the company who sent the spam sued an ISP because the ISP
>     wanted to terminate their contract. The ISP lost; see [1].

That's nonsense. Spammer's frequently cite irrelevant cases and old House
and Senate resolutions that were never passed. (They do so and even violate
that which they are citing!) On a quick read, that case involved a contract
between the UCE entity and its ISP; the dispute revolved around whether the
terms of the ISP's service were violated (was there email truly
unsolicited?) such that the contract can be terminated. AND the judge
hasn't issued its ruling yet!

Our assholes are purposefully forging headers and From addresses to send
unsolicited email. In fact, their service is intended to make it very
difficult for an ISP to take an action against such a spammer, "Forget
problems with ISP 's your IP address will never be shown in our e-mail
headers." This is definitely against the law in some US states [a]. I'm not
sure if its against the law under Federal or Massachusetts law but I have
contacted and spoken with the FTC and the Middlesex's District Attorney's
Special Investigations (Computer) Investigator. The FTC doesn't speak about
any pending actions (they are so weak the typical result is a consent
degree that does not constitute an admission of guilt) so it's hard to say
if they would take any action. (They typically need to receive lots of
complaints.) I hope to hear back from the Middlesex DA or Massachusetts GA
as to whether this is presently violating any local laws.

Ian, did you find out which state they are based in? If we were lucky,
they'd do it to Janet and she could get some money out of them [b].

[a] http://spamlaws.com/state/summary.html
[b] http://www.woodyswatch.com/windows/archtemplate.asp?4-13#watchdog

--

Regards,          http://www.mit.edu/~reagle/
Joseph Reagle     E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E

* This email is from an independent academic account and is
 not necessarily representative of my affiliations.

Re: Spam getting out of hands

Replies:

  • None.

Parents:

Joseph Reagle <[email protected]> writes:

> On Wednesday 03 April 2002 12:21, Ian B. Jacobs wrote:
> > Q: Is this illegal?
> >
> > A: He didn't think so, at least in the US.
[]
> Our assholes are purposefully forging headers and From addresses to send
> unsolicited email. In fact, their service is intended to make it very
> difficult for an ISP to take an action against such a spammer, "Forget
> problems with ISP 's your IP address will never be shown in our e-mail
> headers." This is definitely against the law in some US states [a]. I'm not
> sure if its against the law under Federal or Massachusetts law but I have
> contacted and spoken with the FTC and the Middlesex's District Attorney's
> Special Investigations (Computer) Investigator. The FTC doesn't speak about
> any pending actions (they are so weak the typical result is a consent
> degree that does not constitute an admission of guilt) so it's hard to say
> if they would take any action. (They typically need to receive lots of
> complaints.) I hope to hear back from the Middlesex DA or Massachusetts GA
> as to whether this is presently violating any local laws.
>
> Ian, did you find out which state they are based in? If we were lucky,
> they'd do it to Janet and she could get some money out of them [b].

The State of Maine (where I reside) has been bouncing around some new
legislation ideas concerning spam [c].

Basically the law would be that they [spammers] would have to include
Adv in subject line and a valid email address or website link in the
message.  Pretty weak to begin with but was sailing along fine until
some clown started mucking with it making it less effective.  One of
the reasons he cites is how other states' legislation has been
ineffective and Maine should wait for the US government to address
it.

A more effective law would require no forged headers and a valid From
or Reply-to in addition to Adv, that way I could filter out and
automatically return fire to those that actually comply or comtemplate
suing those that don't if the return volley bounces.  I actually know
a few people in the Maine legislature and am tempted to offer consult
them but figure they probably have too many people involved to begin
with.

I would be surprised if Congress were to pass something useful in a
timely manner as they have flailed to date.  They should have the fore
sight of spammers going multinational and making the end customer
who's site is being advertised legally and therefore also financially
responsible for the tactics the spamming company they are employing
are using regardless of the country of origin of the spam.

I do have to agree that the various state laws have not served as much
of a deterent given the ongoing volume and practices.  Yes there have
been a few people like in the article Joseph cites that have been a
small nuisance to spammers.  It won't be until significant numbers of
people or class action law suits are started that there will be an
economic decision to comply with commercial email laws.  EU or US may
someday actually figure out how and when to properly legislate items
relating to the internet, their track records so far are pretty
muttled.  

> [a] http://spamlaws.com/state/summary.html
> [b] http://www.woodyswatch.com/windows/archtemplate.asp?4-13#watchdog

[c] http://www.portland.com/news/statehouse/020402spam.shtml

--
Ted Guild <[email protected]>
http://www.guilds.net

HURL: fogo mailing list archives, maintained by Gerald Oskoboiny