Spammer Pleads Guilty

Rick Zeman writes: "A spammer faces up to seven years in jail after pleading guilty to "computer hijacking." " He apparently hijacked a mail server, and used it to send millions of forged email to make it come from IBM domains. He's pleaded guilty to forgery and I hope he gets all 7 years. But then again, I also wish someone would get 7 years every time they mail me a credit card offer, or call me and ask me to change my long distance service.

Comments

Re:Does Spam Really Bug Everyone That Much?

[Tackhead]

> Why does everyone get so damn pissed off at spam?

Because it's theft. I don't like being stolen from.

But not just because it's theft. The real fight is how we preserve email as a useful communications medium.

> Add to that the fact that I can block senders,[ ... ]

And how much of your time do you spend doing this, when you could be doing other things? You say you've never had more than 10 a week. Before I started reading headers, I was up to 10 a day. And I'm on the light side. Others I know were in the hundreds per day.

Consider this - if we give Jay Garon net.access in prison, and only 1% of legitimate small businesses (ignoring the MMFools and pr0n-hawkers and snake-oil "pharmacists") in the US spam Jay Garon once a year. Jay will have to "just hit delete" 240,000 times a year. That's 657 a day.

As punishment, I think Jay Garon should have to reply to an email from the warden, three times a day, to get his meals served. Failure to answer the mail within an hour results in no meal service.

Now how long do you think it would be before Jay starved to death, "just hitting delete"?

> Now I just delete and forget.

I used to delete spam. Now I delete spammers.

Speaking of whom... hey Garon, seen any sexy babes lately? How's Premier Financial?

The wheels of justice grind slowly - Garon's spamhaus dates back to early 1999 - but they grind extremely fine. I'm gonna eat an 8-oz filet mignon tonight. I'm sure Jay will be eating meat soon too, but of a different sort.

Buh-bye, Jay. You might as well let the door hit you in the ass on the way out. A little tenderizing might make it easier on ya when Bubba comes a knockin'.

man , you priorities are f*cked...

[xlurker]

• He's pleaded guilty to forgery and I hope he gets all 7 years. But then again, I also wish someone would get 7 years every time they mail me a credit card offer, or call me and ask me to change my long distance service.

you gotta be joking... you think SEVENS years of real prison time is adequate for faking emails?!?!

sure the guy has to pay a big monetary fine, but this isn't in the league an assault, burglary, rape or kidnapping ...

spamming is not a violent crime.

Re:man , you priorities are f*cked...

[Chris Johnson]

Yes, but it's far too easy. Spamming requires nowhere near the effort of burglary, nothing like the directness of assault. The problem is that it is a very socially dangerous behavior that doesn't bear consequences. If you add forgery of electronic messages the 'cost' of spamming goes down so low that just about any half-slime greedhead can convince him or herself that they're doing nothing wrong- and flood the world with the stuff. It's pure 'tragedy of the commons'- the resource being obliterated is not simply people's attention (and computer resources) but their ability to believe a thing they're told. Before the net, you didn't have ten people lying to you and trying to con you a day. Now you can have ten a minute, never ceasing to try to fool you in new and unforeseen ways. I think this situation is very harmful to society in general. There is no 'honesty zone' or neighborhood where you can trust the people, if you're constantly forced to make judgement calls like 'liar- liar- liar- Khouri- liar- friend- liar- language I can't read- liar...'. It affects you.

Seven years seems right to me. I would hesitate to say the guy should be tortured or put to death simply because I don't consider him mentally fit- I think he is insane to consider his behavior socially acceptable, if he feels that is morally OK he is unfit for society. He's not, for instance, doing lots of drugs and frying his brain- that would be his problem. Instead he's directly affecting millions and causing them all to be a little bit more hostile, a little bit less capable of trust- and forging electronic mail to do it, placing the blame on others.

The DA said this: "This office will not relinquish the vanguard of technology to those whose intent and purpose is to commit old crimes in new ways". DAMN straight. This is nothing but an old crime done on an incomprehensibly vaster scale. Con artists are NOT NEW. Having con artists in your face no matter what you do, and being unable to escape them or shield people you care about (your kids?) from them- is new.

No parole. Make him serve all 7 years- and he'd better have got a clue by then.

Low Down Dirty Horse Thieves

[AllInOne]

In the old days it was a big insult to call someone 'a horse thief'.

Imagine trying to implement a reliable security scheme to protect horses from theft.

Horses are easy to steal/hard to secure. They provide their own get away vehicle, and even identification/proof of ownership can be unreliable. (Branding is write once, read many)

The result was that punishment for horse theft was DEATH or worse.

The punishment isn't only based on the value of the thing stolen, but also on the consequences to society if the type of behavior continues...

It is because Spamming is so easy to do and easy to get away with/hard to prosecute that the punishment should be harsher than other crimes.

Re:Low Down Dirty Horse Thieves

[Col. Panic]

The result was that punishment for horse theft was DEATH or worse.

The result of what? The penalty for horse theft was probably so high because a horse was *so* valuable in the old West. Imagine having your only source of transportation taken when the nearest source of food or water might just be unreachable by foot. The impact of bringing down a mail server is not quite the same.

I know a couple of people who were sentenced to 5 years in prison for attempted murder. Again - not quite the same class of crime. I am no lover of spam, but 7 years???

Re:Low Down Dirty Horse Thieves

[Fjord]

>The result was that punishment for horse theft was DEATH or worse. The result of what? The penalty for horse theft was probably so high because a horse was *so* valuable in the old West.

No, the penalty was high because, like the original poster said, it was a deterent to a crime that could be easily gotten away with. It was for "rustling," not stealing a single horse. It was for rustling cattle, as well. The problem was that it was easy for people to come in at night and rustle animals. To prevent people from doing this, a high penalty was given. If it was just 6 months in jail, then it was be worth it to take the risk of rustling. If it's death, then the risk is often too high (but not always, apparently).

7 Years is Too Much

[BenGarvey]

The punishment is supposed to fit the crime, and I can't agree that it would take 7 years to straighten this guy out. Inprisonment is not to be taken lightly. What would this guy learn in 7 years that he would not learn in 5? 3?
---
Ben Garvey

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Does Spam Really Bug Everyone That Much?

[CoughDropAddict]

Why does everyone get so damn pissed off at spam?

I can't post to USENET with an e-mail address that I actually use (I did once, and I'm paying for it now).

I can't read much of USENET with the S/N ratio being as low as it is.

Those are my two main gripes.

--

Re:Lousy admins don't help:

[mpe]

This kind of crap -- "hijacking", they call it -- wouldn't be possible if sysadmins would LEARN how to SECURE their mailservers!!!

Or if they must run third party relays (e.g. to cope with crippled software.) They make sure that their machine adds IP address, reverse DNS, identd to the headers and has an accurate clock.
Anyway with just about any modern piece of software you explicitally need to set it up to act as a relay in the first place.

What would be worse...

[jamus]

make him eat SPAM every day for 7 years.

That would be a deterent.

Re:What would be worse...

[Bios_Hakr]

Why waste good canned meat on a worthless spammer?

Re:Does Spam Really Bug Everyone That Much?

[dmatos]

That's the whole point. It is a non-issue with me because I sheild myself behind a hotmail account. I find it much easier to sift through spam when there are almost no useful messages in the box. As such it takes such a small amount of my time that I can't even be bothered getting upset at it. In fact, I find some of the spam so lame it makes me laugh, and we all know the world could use more laughter.

Seven years?

[swingkid]

No way this guy does 7 years for this; he'll be out in 6 months.

Heh. After 7 years in the slammer...

[StandardDeviant]

That fuckhead spammer is going to look like the ``starring attraction'' at goatse.cx. I think millions of mail system administrators and mail users everywhere have just been avenged...

Note that this is supposed to be an in-joke for those that have already inadvertantly been to goatse.cx, I don't advocate going for those of you whose eyes are untarnished. You Have Been Warned.

--

You can curtail snail spam

[Planesdragon]

The phone spammers have to take you off their list if you ask; if you ask, and they call again in a certain time period (one year?) they are liable for $500 per call. (IIRC)

As for credit card offers; just call the three credit reporting bureaus and ask to be taken off of *their* lists.

Re:You can curtail snail spam

[Tackhead]

> The phone spammers have to take you off their list if you ask;

One minor, but important, nit to pick:

You don't ask to be taken off their phone list - you ask to be put on their do-not-call list.

It's a subtle distinction between the letter of the law (they have to maintain a do-not-call list and not-call the numbers on it) and the spirit of the law (which you describe).

Phone spammers are almost as scummy as email spammers. Unless your request ("Place this number on your do-not-call list") conforms with the letter of the law, they can (and most likely will) ignore it.

Re:You can curtail snail spam

[plover]

The exact phrasing I use is:

Please add this number to your do-not-call list and never call this number again, thank you.

Politeness helps -- I almost always get a polite "OK, sir" reply from them, I'm off the phone in ten seconds, and I really don't hear from them again. My phone spam has dropped dramatically, to maybe two or three calls a week from a high of about three calls per night.

John

Re:You can curtail snail spam

[Quikah]

Actually the big telemarketing firms are easy to avoid. When you answer the phone the computer dialed telemarketers take a second to transfer your call to one of their waiting minions. So if no one answers you immediately after saying hello, hang up. I haven't listened to a long distance pitch in years. Sure it takes a couple of seconds of your time, but it is no big deal and it is easier than getting your name removed from their list. I am lazy. :) (Though I suppose it would take less work overall to just get my name removed...)

Re:You can curtail snail spam

[iElucidate]

I've tried that idea several times. They generally just hang up on me when I ask to speak to a manager, get an address or phone number, or ask to be removed from their lists. This so-called "law" is so difficult to argue successfully that it is basically worthless.

Re:You can curtail snail spam

[Posse Fokker]

...just build up an atrocious credit record...

I don't think the credit card people care about that. Years ago, Sears gave a $5 discount on any sale if you filled a credit card request form. I filled one of those every time I bought at Sears, as long as the promotion lasted. For every $100 I got in discounts, Mr. John Weissmuller, #2225 Poinsettia Ave. Huntington Beach CA, Social Security #618-32-8263, California driver license A8342885, got 20 Sears credit cards.

His guilty plea...

[lambda]

He actually passed his guilty plea to the judge in the form of a chain letter:

Please e-mail this plea to 5 people in the courtroom, who will then in turn e-mail it to 5 more people...

Failure to do so will result in the death of your immediate family, increase of Oracle pricing for your employer, and the installation of RedHat 7 on your C++ development machine.

Thank you.

Injustice

[Rheingold]

While I'm happy there are laws against this sort of obnoxious behaviour, I'm sickened that someone will go to prison for this and that so many of you (CmdrTaco included) would take that punishment so lightly. Fines, probation, community service, etc. are all acceptable for this sort of offense. Prison should be reserved for truly dangerous criminals.

Wil
--

Re:Stopping spam

[sethg]

Only allow one message to be sent per second, per client, by each mail server.

How can this rule be enforced?

• Any computer with a direct connection to the Internet can serve as a mail server. You can't trust that every person who can plug an old 486 into a DSL line will follow your rule.
• An ISP could prevent every one of its clients from sending more than one email per second through its gateways. However, the good ISPs already enforce anti-spam policies. If an ISP doesn't want to enforce such a policy, it has no reason to enforce the rule you propose, either.
• In theory, when ISPs exchange traffic with each other, the receiving ISP could insist that the transmitting ISP only send one email message per client per server on its network. But in practice ... how would the receiving ISP filter through its incoming packets to enforce this policy efficiently?

--

+5, Insightful

[Mike Schiraldi]

Moderate that guy up.

--

Stopping spam

[david.given]

Many years ago I worked out a simple way of preventing spam. AFAICT, it'll still work. It's dead simple:

Only allow one message to be sent per second, per client, by each mail server.

To individual users, this is no hardship. (My mailer takes longer than that just to do its housekeeping.) Mailing lists will, of course, need special treatment, but they should be on special mail servers anyway.

But this would be the kiss of death to spammers. Now they can only send 60 messages per minute, 3600 per hour! Now it'll take them just under two weeks of continuous connect time to send a million messages. It's now not worth the effort to do it.

The changes to the mail servers should be pretty simple, too. There'd be a bit of extra overhead, but not much. You'd have to keep track of who connected in the last second to prevent people connecting, sending one message, disconnecting, reconnecting, sending another message, etc.

Any ideas if there's anyone I could suggest this to to find out if it's actually workable? (Other than here?)

Re:7 YEARS???

[Arandir]

The word "hacker" predated computers by decades. It meant someone who who did "quick and dirty" work with no regard to quality. In the building trades, a contracter who works quick and dirty is called a "hack". A general contracter who is behind budget will tell his foreman to "go get a hacker". Or consider the hack writer. He wants to write the next great novel, but he has to feed his family so he hacks out romances.

Does this meaning fit today's computer hackers and "crackers"? Scary, ain't it?

7 years? Too much

[Ektanoor]

Not even Mitnick got half of it. I think the guy needs another correctional measure. To write 1000 time "I'm sorry" and be kept in jail until he writes up 2,5 million times the stuff... That's a good punishment for a spammer.

Hey if he will write 1000 "I'm sorries" a day, that will mean 7 years... Oh damn...

Spamming .... and creatin' a nuisance

[billstewart]

"What were you arrested for, kid?"

7 years in prison does seem a bit harsh. On the other hand
"I had to pay $50 and pick up the garbage."
sounds a bit light.

Re:Does Spam Really Bug Everyone That Much?

[Wolfier]

>heady enjoyment of corrupting spammers'
>databases

Yeah. Damaging their databases unknowingly. Go to their site, manually edit the cookies. Let them retrieve them and corrupt their databases by their own hands.

If there's a software that does this for you. I'll pay for it.

Now is there any?

Re:But an open relay is the right thing to do

[Tackhead]

> An open mail server is likewise a nice thing to provide for those people who have unreliable internet connections. [ ... ] Trust for your fellow man should be the normal way of dealing with things.

5-6 years ago, it was. That's why so many servers are still open - they're run by lazy admins, or come configured with relay turned on by default (Sendmail 8.6 on SUN, anyone?)

Today, it's not. The 'net changes. Deal.

> Locks should be to prevent kids from playing with balsting caps, not to keep theives out.

Today, an open relay is an "attractive nuisance" - that is, it's analagous to leaving your garage, full of blasting caps, wide open, and hanging a sign on the door saying "Hey kids, don't come in here and play with the blasting caps!"

I think you're actually trolling, but I'll take you seriously for one more moment.

> An open mail server is likewise a nice thing to provide for those people who have unreliable internet connections.

If you're operating such a relay as a favor to a friend in such a situation, it's your responsibility to make sure it's not abused.

By way of constructive suggestions, you can require that users of your relay authenticate before using it, or you can restrict use of that relay to a specific IP address.

Re:Lousy admins don't help:

[mr]

If you want to cure an open relay problem, send the admins a message or contact ORBS. It's absolutely asinine for people to use other's systems without their approval.

Lets see. You advocate the use of ORBS, yet ORBS launches a 15+ test attack on a target machine WITHOUT the premission of the sysadmin of the machine who's accused annonymously of having an open relay.

If it is asinine to use anothers system without premission, then why advocate ORBS, who do exactly that....launch a 15+ probe attack VS a host without that sysadmins premission, all based on submissions which proof can not be provided for?

Re:While we're at it...

[pjrc]

I see, fundamentally, no difference between forging a check to steal money from a persons account, and what spammers do.

The subject of "harm" is perhaps one place to look. In the case of check fraud, the money or property probably won't be recovered, or only partially recovered, and either the bank or account holder will take a loss. In the case of spam, a whole lot of users press delete, maybe an ISP bears some bandwidth or mail server load (low incremental cost), and maybe a couple stupid suckers fall for whatever scam the message is hawking, and take a minor loss, but from their own action (any they probably learn something from it).

Now this guy crashed someone server by sending too much stuff so quickly, so there is some real harm, but 7 years in jail? I'd personally like to see him do at least a little time, perhaps only to strike some fear into all the other spammers out there, but 7 years sounds pretty damn harsh.

Re:Prison??

[finkployd]

This is evidence of a judicial system that is more about revenge than correction.

I always thought it was about punishment, neither revenge nor correction. Just good old fashioned punishment for a crime. 7 years is a little extreme and I'm sure he won't get that, but there should be some punishment.

Finkployd

Re:While we're at it...

[Tau Zero]

The subject of "harm" is perhaps one place to look.... In the case of spam, a whole lot of users press delete, maybe an ISP bears some bandwidth or mail server load...

Maybe the ISP's mail server crashes under the load of the hate-mail.

Maybe the ISP's staff spends dozens or hundreds of hours fielding the responses from people who were spammed demanding that the ISP do something about the spammer.

Maybe the ISP finds itself blocked by hundreds or thousands of mail admins around the world, and its subscribers decamp en masse because they can no longer get mail through. The ISP then goes belly-up.

Unless the spammer is willing to bear ALL of those costs (and has an agreement with the ISP holding the ISP harmless, sufficient credit to pay the costs, etc. etc.), s/he should go to jail as the thief and vandal s/he is.

Spam is theft of service. Spammers have no business existing. Anyone who spams should have to pay back the trebled costs of their damages (including people's time to download, recognize and delete the spam) preferably from wages earned from a work-release program shoveling muck out of sewer pipes (one of the few poetically just outcomes). Or they could just die painfully.
"
/ \ ASCII ribbon against e-mail
\ / in HTML and M$ proprietary formats.
X
/ \

7 years? That is too much

[gando]

Although I hate deleting spam as much as the next guy, this is ridiculous. Considering other all other crimes, 7 years is a ludicrous amount of time for anyone to spend in prison for a crime that causes little harm.

I see that the Legislature and "Justice" departments are at it again, they are trying to set punishments so the first people to be punished are examples for those to come.

I detest this bombastic view that has been done in many computer crimes, and when compared to other crimes, the amount of prison time, and monetary punishments just don't jive with other crimes.

It seems that computer crimes are becoming the drug crimes of their time. This is a just another example of a misunderstood boogie monster crime that must exaggerated in media coverage and criminal punishments. All this does in the end is fill our prisons with over punished people. This costs us too much money and causes us to have more criminals in the end.

I think 1-12 months in a county jail would do the trick, don't you? If not subsequent violations could result in a few years of prison, but really, I'd rather delete a few extra e-mail a day then pay more in taxes for prisons, and cause the creation of more criminals.

-My $0.02

Hormel should get involved.

[moofbong]

Maybe if Hormel started suing people for using their patent... ;)

Re:Relaying

[Chris Mattern]

> After all, no-one is complaining that having
> open mailboxes outside every post office is a
> security problem

Yes, they are. You can no longer post packages
via public mailbox because of security reasons.
Remember the IMF protests in Washington back in
April? I work half a dozen blocks from the IMF;
I remember when the security guys came and removed
all our street mailboxes to prepare for the
protests. They did put 'em back afterwards, but
still, it was a pain.

Chris Mattern

His plea

[Slngal 11]

He actually passed his guilty plea to the judge in the form of a chain letter:

Please e-mail this plea to 5 people in the courtroom, who will then in turn e-mail it to 5 more people...

Failure to do so will result in the death of your immediate family, increase of Oracle pricing for your employer, and the installation of RedHat 7 on your C++ development machine.

Thank you.

Usenet and spam

[dmatos]

Okay. I agree with you here. Spam is harmful in open forums where there is no way to filter it. Imagine if people started advertising pornography here on slashdot, and there was no way to... oh, sorry.

I figure that if other people aren't using free e-mail accounts to filter out their spam, and then complain about it, they rank on the same level as sys admins who don't apply the latest security patches and whine when a skript kiddie roots their box. I appreciate your "once-bitten twice-shy" scenario, though. I had one of those too.

Re:Usenet and spam

[CoughDropAddict]

I figure that if other people aren't using free e-mail accounts to filter out their spam, and then complain about it, they rank on the same level as sys admins who don't apply the latest security patches and whine when a skript kiddie roots their box.

I think you could better compare them to people who voice opinions with their real name and then are upset when they get harassing mail and phone calls for it. I shouldn't have to live in anonymity for fear of what spammers will do if they know where my address is.

Of course I have a spam-collecting account. Now call me crazy, but I'd like to be able to post my real e-mail address to newsgroups, in case a real person wants to contact me! I don't want to wade through pages of spam on a regular basis, just to see if someone has privately responded to a post of mine.

Not to mention that an e-mail address is part of your online identity. The domain indicates something about you; whether it be your educational institution, place of work, or what you associate yourself with. The e-mail address is a sort of distinctive mark, and personally I'd much rather post with a name that really identifies me than coughdropaddict@hotmail.com, just like I'd rather give a street address than a PO box.

--

Re:7 years for spamming?

[dattaway]

7 yrs is too harsh. make the punishment fit the crime.

Cut off his hands?

Re:While we're at it...

[dmatos]

Ah, I think you hit on a point here. I'm too lazy to look up the law, but if I walked into a house that had an open door, I can't be charged with "breaking and entering". I think the most I can get is "illegal entry". IIRC, B&E requires that the criminal either break something or open something, with the intent to gain entry and commit another crime.

An open port is an open door. (H|Cr)acking a firewall is B&E.

While we're at it...

[iElucidate]

How about we give 7 years in jail to everyone who ever breaks into a computer system? I mean, I sure hate spam as much as the next guy, but "hijacking" mail servers is a crimial offense now? And 7 years jail for doing it? Incredible! How could we endorse this when we as a community often advocate white hat hacking and general system exploration? I mean, a civil action would be merited, and perhaps some monetary penalty, but JAIL??? I don't know, this worries me. It is a dangerous precedent.

Re:While we're at it...

[tswinzig]

I mean, a civil action would be merited, and perhaps some monetary penalty, but JAIL???

I agree, but I think you are simply arguing about a libertarian system vs. our current legal system.

Re:While we're at it...

[lizrd]

any more than an unlocked mailbox implies an invitation to open the mailbox and read the mail inside.

Well, that's just what I'm pondering. I would believe that I'd be within my rights to make use of a public resource (such as a mailbox) even if it does not belong to me. It is completely acceptable for me to deposit my outgoing mail into an unlocked mailbox (provided that said letters are not in themselves illegal). However, it is not permissable for me to remove things from the mailbox which do not belong to me or to place things into the mailbox which do not belong there.

It is my belief that open ports on computer systems are an invitation to make use (note: I am not saying abuse) of those resources. If you don't want those resources used by the general public then you need to close those ports or protect them in some other way.
_____________

Re:While we're at it...

[TheCarp]

Ethical check fraud?

Well how about I find a bank whose checks are extremely easy to forge because of something that they could easily fix (of course the truth is that any checks are easy to forge...since a forgery doesn't even have to be good enough to fool a bank in most cases)

So I forge a check for $0.01 (or $0 if possible...or some token amount) and immediatly have the money deposited back into the account that I forged it to be from.

The point of "ethical" hacking is exploiting the system, not for personal gain, but to expose the problem and get it fixed. Check out the story in the jargon dictionary "The Meaning of Hack" and read the last story.

It was about some motorola engineers in the 70s who found a severe security bug in their OS, they couldn't get the vendor to fix the problem, so they used it to gain access to the vendors system and placed an "example" of the problem there.

Now....ill admit the example was one where the people went quite oveboard and did do some damage (making a card stacker shuffle peoples punch cards is just plain mean!)

Of course...I guess the thing is... when it comes to actually hacking in the "break in" sense, for it to really be a hack it has to be novel, it has to be original, it has to have style.

Pounding a system thousands of times over to send out mails, and not a single one of them being to postmaster telling them that their system is open? Thats not original, its not novel, and it completely lacks style.

Its more than an offense of stolen resources, its an offense against good taste.

-Steve

Re:While we're at it...

[lizrd]

Just because they don't put a lock on the door doesn't constitue an invitation.

There's a little bit of a difference when you place a service on the internet. By leaving the port for some service open to the public you have in effect issued an invitation. Placing a public resource in a public place and being surprised when it is used by the public is stupid. If I open port 80 on my machine I should not be surprised when people connect to it and attempt to use the http resources on my machine. Why would I expect it to be any different if I leave port 25 open on my machine?

I think that an apt analogy is if I were to put a drinking fountian on my front lawn adjacent to the sidewalk. If you happened to feel thirsty as you walked past my home you could reasonable expect that I had extended an invitation to you to drink from the fountian since it was placed in a public place. If you were to connect a hose to it and use it to fill your swimming pool that might well be a different legal and ethical question.

One should be able to place a resource avaliable that is available to the world and expect that it not be abused. The internet and human nature being what they are though that just might not be the wisest decision. Something to think about anyway...
_____________

Re:While we're at it...

[tswinzig]

> but JAIL???

I've found that a pretty good way of not going to jail is not to commit crimes like theft or forgery. Works for me.

A better way is to require restitution to the victim, in the form of a lump-sum payoff, or garnishing of wages. This is the libertarian way of doing things. If the person cannot or will not work to pay off their debt to the victim, then they would go to jail.

Jail simply turns people into criminals, and should be a last resort, not a first. IMHO.

-thomas

Re:While we're at it...

[drudd]

There's a big difference between finding a
security hole in someone's system, and immediately
notifying the sysadmins so they can close
it.

Hijacking an email server, and committing
thousands of cases of fraud is another.

Email is worthless if we cannot trust that the
apparent author is the true one.

Doug

Re:While we're at it...

[dmatos]

Hmm... Okay, but I prefer to think of an open port as an open door, and the web browser is just really polite. It shouts into the house "Hey, have you got a page for me", and someone inside replies.

The fact that an open port is a completely unguarded entry point into a computer system makes it analagous(sp?) to an open door to me.

Re:While we're at it...

[Tackhead]

> Unlike forging a signature on a cheque, or an official document, there is nothing in the RFC822 headers of an email that was ever designed to act as proof of a message's origin.

Crap, that's an excellent point. Moderators? Mod this guy up!

I'd have to look at the forgery statute to see if forging a HELO really oughtabe "forgery" in the criminal sense.

It's certainly a false representation, and it's certainly intended to deceive people as to the message's origins in order to perpetrate fraud.

But I think I may be mixing up my (meager) understanding of law with respect to forgery and fraud. (That is, it's OK to send a funny email on April Fool's Day as alan_greenspan@really.really.big.bank.gov, since it's clear to a reasonable person that you're not Greenspan. Doing the same thing, but sending economic statistics portending the interest rate bias for the upcoming fed meeting, to a bunch of Wall Street analysts, wouldn't be.)

The interesting thing if I take that "reasonable person" standard - is HELO ibm.net - believable to a reasonable person?

When I see Recieved: from ibm.net (luser.dialup.uu.net [63.whatever]), whether as a relay rape or direct-to-MX, I know it's a forgery. I wouldn't reasonably believe it came from IBM. I would believe that the spammer is trying to fool others less knowledgeable into thinking that it was.

I think it's more fraud than forgery, but the distinction's probably too subtle to really be captured in the law as it's currently written.

Like I said - a damn good point you made.

Re:While we're at it...

[Tackhead]

>> What part of "theft by trespass to chattel" do you not understand?
>
> The chattel part.

Chattel: Lawyerspeak for "stuff".

From mycounsel.com

Chattel refers to personal property such as a car, pet or jewelry. Trespass to chattel is basically theft, but can also be the temporary "borrowing" of an item. A wrongdoer commits trespass to chattel if he or she intentionally possesses someone else's property without their consent--even if only for a brief period of time. Most courts require that some sort of actual harm result from the trespass to chattel.

Example: If you take your friend's new convertible for a joy ride without his or her authorization and during the course of your ride you scratch the new paint and dent the back fender, you have committed a trespass to chattel

So - if I dump three million spams through your mail server without your authorization, and during the course of that, I saturate your outbound link and/or fill up /var/spool/mail with bounces, you've (a) been harmed by having your bandwidth eaten by me, and (b) been harmed by having real mail dropped on the floor from the full mail spool. To say nothing of (c) the time it takes to clean up the mess.

It's an open-and-shut case, and if your relay has been compromised in this manner, regardless of your moral responsibility to secure the relay in the first place, you can sue the spammer for the damages.

Re:While we're at it...

[BigBlockMopar]

I've found that a pretty good way of not going to jail is not to commit crimes like theft or forgery. Works for me.

Agreed.

I hope Bubba likes his delicate features and then doesn't use lube when he consumates his relationship with the spammer.

Re:While we're at it...

[TheCarp]

I disagree.

I see, fundamentally, no difference between forging a check to steal money from a persons account, and what spammers do.

They connect to another host, and exploit a configuration flaw to send mail through it. They masquerade as a legitimate user (just as a check forger masquerades as a legitimate check writter for an account) to achieve their end.

Now hacking is another story. I see no problem with "hacking". Exploiting holes to gain elevated privilidge for the sake of doing it...and then closing those holes and helping those who run the system to fix the problem...thats another story.

There is quite a difference between breaking in as an example, the so called "ethical hacking", like what happend to slashdot a few weeks/months back, and exploiting a hole for personal gain.... over and over again.

Spammers are the most unethical creatures! They join online services with full intention of violating the Terms of Service. They search for "weak" hosts and then use them to launch their spam.

They remove all of the grief onto others. They cause the admins of the systems (who are not totally without blame usually) to get floods of abuse reports and cause them lots of greif. They then just open another account and do it all over again - closing their account doesn't even slow them down! As an added bonus, their mail floods slow down the hosts that they are using - causing mail delays and resource issues for legitimate users of the machines.

It is simple theft of resources, and they do it over and over again. Reaping the rewards at essentially zero cost to themselves. They can send out thousands upon thousands of messages for mere pennies.

If they setup their own domains, with their own legitimate mail servers, and used those to spam from - then I wouldn't have a problem with them. Of course, every mail server and ISP in existance would have them blocked at the boarder router within a week, and they know it - so they act like parasites, feeding off weak systems - and transfereing all of their costs to others.

They change their usernames and things often (want to see my spam message folder? Its interesting to see the tiny changes they make to things - one has to imagine specifically to get around blocking filters)

Make an example of the bastards I say. They are parasites.

-Steve

Re:While we're at it...

[TheCarp]

Actually... ive never really seen the whole point of keeping a lover "locked up"....

I mean... sex is fun right? If you love someone, why would you want them to not engage in it? Can't they have fun with another person? Should they not be allowed to play poker with a friend or play video games?

Really...its just sex. Sex is fun, sex is natural. A person is not property, trying to lock them up and keep them to yourself is silly.

but yes... its true intrusion does cause headaches. As an admin who has had to deal with them in the past, I can attest to this. However, as far as I can tell, ethical hacking doesn't really happen anyway. Every time we have caught it, it has been some script kiddie who wanted to setup an IRC bouncer so they could be a nuisencse or to deface a web page.

Quite frankly, I have a problem with punishing people for mere curiosity. A person is curious, they reach out and touch and try to identify, they try to ifind out how something works or what they can do.

Is it always right? no. But I think intent DOES matter. Accidental harm is not the same as malicous harm. Really, a 7 year old can tell you that. There is a difference between misjudging how far away someone is and hitting them with a board you are moving, and purposfully knocking them in the head with it.

Intent of action means just as much to me as any other factor. Certainly killing a person through negligence is very bad. However, its nowhere near as bad as killing them with purpose, with intent.

Quite frankly, I don't think it even really matters. I think you will find that if the legal system or whatever one wishes to use for dealing with social ills is pointed at thos who are malicous and harming through willfull negligence and intent, that is plenty of work and those who screw around out of curiosity are much less of a problem, and tend to fall to the level of simple infrequent annoyance.

-Steve

Re:While we're at it...

[idioms]

>I've found that a pretty good way of not going >to jail is not to commit crimes like theft or >forgery. Works for me. yes ... jail has been so effective for the americans ... the decades of institutional detainment has worked wonders in reducing crime. The real problem with sentencing computer crime is that anyone can cause a large amount (more importantly undefined quantities like rep, downtime etc) of damage fairly simply. One doesnt have to be criminally insane to hijack a mailserver ... on the other hand you would have suspicion about someone who burnt down a building housing a mailserver. Computer crime is something that the law is currently completely ill equipt to deal with. The courts do not understand the technology na dare attempting to apply property laws without considering whether it is appropriate, while being caught up in a media that is more than willing to exploit ignorance for a juicy story with 7 figure damages ...

Re:While we're at it...

[Nicolas MONNET]

How do we know that you are the real Doug Rudd, mister?

Hell, it's easy. The real Doug Rudd is user ID # 43032.

--

Re:While we're at it...

[Tackhead]

>I mean, a civil action would be merited, and perhaps some monetary penalty, but JAIL??? I don't know, this worries me. It is a dangerous precedent.

What part of "denial of service attack" do you not understand? (Ever seen an open relay try to process 500,000 bounces?)

What part of "theft by trespass to chattel" do you not understand?

What part of "unauthorized access to a computer system" do you not understand?

But honestly, I'm glad they got him on the forgery charge instead of all of the above charges (i.e. forging a bogus return address) - because it's a very real attack (via 50,000 flames!) on a victim whose systems were completely unrelated to the damn open relay in the first place.

And it's a hell of a lot easier to say to the owner of a forged domain "consider suing the spammer for trademark infringement for forging your domain name into the spam" (civil suit launched at the victim's expense) to "Please contact the district attorney in (spammer's dialup's general area) and ask him to place criminal fraud charges upon the spammer" (a criminal suit).

> but JAIL???

I've found that a pretty good way of not going to jail is not to commit crimes like theft or forgery. Works for me.

Re:While we're at it...

[Trepidity]

Ah, Slashdotters love to emphasize how evil spammers are, attempting to construe what they're doing as theft, and then turn around and justify downloading mp3s as not being theft.

Crime for every email sent

[shinji]

It does not specify but they should charge him with fraud for every email he sent. Lets see that would be about a million counts of fraud...that should up that sentance quite a bit. That way the bigger a spammer as person is the more years and bigger fines they can get.

Re:Crime for every email sent

[The-Bus]

Well, what I realized as I was looking through the comments is that more people prefer the spammer to be fined than jailed. What's the chance, however, that the spammer has any money? Would you spam if you had any money? I think a jail sentence is OK, but I don't know about 7 years.

Re:Proportional Response?

[Erasmus Darwin]

Taking someone's car for a spin w/o permission or pirating airwaves on a spectrum allocated to someone else are probably comparable law breaking actions

I'd argue that a closer analogy would be taking a delivery truck for a spin in the middle of the day, while it's full of merchandise that needs to be delivered. Furthermore, that analogy doesn't cover the resulting backlash of spam complaints back to the source. It'd be as if a number of the thousands (millions?) of people that he cut off in traffic all called your business to complain about your reckless driver.

Re:But an open relay is the right thing to do

[mpe]

An open mail server is likewise a nice thing to provide for those people who have unreliable internet connections. I temparly store mail on your server until my buddy gets online, and then you send it while my server is offline.

Well you could have a neat system which works the following way... When you want to send mail you check with something (e.g. DNS) where to send it. Getting back a list of possibilities (which can be spread all over the world. All nicely documented in RFC 974...
Now why exactly do we still need third party relays?

Re:Uh, doubtful

[ichimunki]

And this seems very reasonable. I don't like unsolicited email as much as the next person, but in the grand scheme of things, computer hijacking is relatively benign... even if it was used for the nefarious purpose of forgery. Unless it can be shown that this guy bilked old people of the money they needed to eat, or that his forgeries created some real hardship for someone else, the crime is a nuisance, but it's hardly an anti-social danger that deserves punishment like being locked in small cages with people who think shooting their friends over sports paraphernelia or minor grudges is a good idea.

Lousy admins don't help:

[Wakko Warner]

"He executed the scheme using the computer resources of the Market Vision graphics studio company, authorities said, and an overload of data crashed the company's internal network. Ed Greenberg, owner of Market Vision, said his losses amounted to about $18,000.

If I had a dollar for every open relay on the Internet, I'd be a very rich person. This kind of crap -- "hijacking", they call it -- wouldn't be possible if sysadmins would LEARN how to SECURE their mailservers!!! Here's a hint: turn off relaying! It's absolutely asinine to allow the entire Internet to send mail through your machines; hopefully $18,000 in losses has taught this person that.

- A.P.

--
* CmdrTaco is an idiot.

Re:Lousy admins don't help:

[ewhac]

Got any suggestions on just how to do that?

I have a teensy little Celeron box (running FreeBSD 4.0) I've been planning on putting live on my SDSL connection for months. The idea was to get my own domain, with local Web and email service under my own control, and then shop my connectivity.

To date, I haven't put the machine on the air. The reason I haven't done it is because, frankly, I don't know how to properly secure it. Sure, I could turn it on and hope for the best, but I don't want to be put in the class of "idiot sysadmins" because I'm not an idiot. In fact, it's because I'm not an idiot that I haven't put the box on the air yet. I want to do the work properly so I don't ruin someone else's day.

Taking solely the issue of securing a mailserver, I have a copy of the whacking great O'Reilly book on 'sendmail', which I have read almost cover to cover. I sort of grok the sendmail.cf syntax, but even with the 'm4' macros to generate the stuff for you, 'sendmail' is still a bitch to configure properly. And besides the relaying issues, there's also the cutesey 'sendmail' features, such as command piping, remotely directing mail to particular files, etc. Do I knock those out as well? What are the tradeoffs?

And then once I get 'sendmail' configured, then I get to worry about not fscking up the Apache config and opening myself up to who-knows-what vulnerabilities.

I'd also like to remotely administer the thing, which means setting up, learning, and understanding 'ssh'. Oh, yeah, the box may also need to function as a firewall; how do I set that without killing my ability to play Quake/Half-Life/Unreal Tournament/Diablo-II? Do I use simple filters? IPChains? Something else? What are the tradeoffs?

I'm not a dunce; I can understand this stuff. What I lack is the time to go hunting down the discrete resources, and the knowledge of how they all interrelate. And there doesn't appear to be a central resource (at least, not that I've found).

I'm trying to be a good netizen. But saying, "SECURE YOUR FSCKING MAILSERVER," suggests that being a good netizen is much easier than it really is, which can be misleading to the people wishing to wade out into our pond.

Schwab

Re:Lousy admins don't help:

[Wakko Warner]

I think if a thief stole you car, and his excuse was there was no reason for you to leave your car in it's default, stealable state, you wouldn't accept that excuse.

Fair enough, but if your car kept getting stolen, since you didn't lock it, left the engine running outside all the time, and perhaps put a big sign on it that said "steal me!", I wouldn't feel any sympathy for you. Furthermore, if you let it happen more than once (hell, theft of service happens hundreds of thousands of times with open relays) I'd simply point and laugh, for quite some time.

And yes, "it's not that hard, dumbass." There are several websites out there that teach people, in clear, concise steps, how to close an open mail relay, for both UNIX and NT; hell, for just about any operating system. People go to jail for leaving guns lying around when a kid picks one up and shoot someone. Why shouldn't people at least be scolded for running open mail relays when criminals use them to harass?

- A.P.

--
* CmdrTaco is an idiot.

Community Service...

[cnkeller]

Jail time is perhaps a little harsh, how about community service time for every mail message sent?

I'm all for not coddling people, but seven years for SPAM (yes I hate it too) isn't realistic....

You pay for your email box?

[dmatos]

That's the whole point I'm trying to make. Manage spam by having your real account, as well as a *free* account from hotmail, yahoo, or wherever. Whenever you need to distribute your email on the web, use the free account. When dealing with people you trust, use your real account. Then, when you find you free account getting overloaded, drop it and create a new one.

I agree with you that spam is a Bad Thing(tm), but there are a couple of simple steps you can take to minimize its effect on your life.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Poor analogy.

[fibonacci8]

Seems more like the guy calls someone's house asking if the homeowner has a gun. The homeowner says yes there's a gun at the house. The guy then proceeds to load the gun with millions of his bullets and shoots lots of people in the mailbox.

Disgusting proportion

[TroyFoley]

If he gets 7 years, it's a sad day indeed. Mike Tyson got less then 7 for rape, didn't he?

Re:Disgusting proportion

[ahaning]

Jason Garon, who entered his guilty plea Friday, faces up to seven years in prison.

*UP TO* 7 years.

Marketers like to use the term "up to" a lot. It suggests that you can get something that, in reality, will rarely happen. Few people will ever get a 56000bps connection out of their 56k modem. Cable modem and DSL providers will tout their services as being many times faster than a pokey dialup service. You can get up to 50x more speed! Well, only if you're transferring within a 100yd radius or from a superfast server.

Anyway, just because the article says that he's facing up to seven years, doesn't mean that that's what he'll get. Like someone said above, he'll likely only get a couple months. And I would even dare to say that he should get less, if not then just have to stay in a minimum security prison. Maybe keep him from the web for a while. When he's out, monitor his connection for a year or so (though he could just go to another connection somewhere else, law enforcement officers haven't got the time to follow him around). Geesh, why not make this a good time to get people to use mail filters and secure their mail servers. If you don't want the possibility of someone using your service for some use other than what you intended, don't make it available. This is IBM, too, they've been around for a while. They should realize that they have a big name in the industry and need to be careful.

With that, this will not stop the deluge of spam entering your inbox. Just like lameness filters won't stop "trolls", yelling at this guy will not stop spammers.

Listen, he's NOT going to get 7 years

[Galvatron]

Fer Chrissake, listen to yourselves. Does no one here understand that this is a MAXIMUM penalty? The whole reason behind pleading guilty was so he'd get off with less. I doubt he'll be in jail longer than one year, assuming good behavior and whatnot. This hardly seems like an inappropriate punishment for breaking into a computer system and using it for illicit purposes.

In fact, the sympathetic response by many of those on Slashdot suggests to me that maybe punishments need to be made stronger in order to firmly establish that breaking into someone's computer is NO DIFFERENT from breaking into someone's house. If you want to take a look at someone's house, and slip a note in their mailbox if you notice they've left a window open, well that's one thing. If you crawl through the window and take a look around, even if you don't do any damage, that's a problem.

It's fraud.

[ca1v1n]

Imagine this:

Congress is about to pass a change to the tax code that would place a 50% tax (a sin tax, in the spirit of tobacco) on beanie baby sales. As a professional beanie collector who makes his living selling them on ebay, this would put quite a crimp in my business. Although nobody has sympathy for beanie baby collectors, I figure that senior citizens have a lot of clout. (they do) So, I write up a letter on faked AARP letterhead that tells them that the new tax bill will place a 50% tax on Social Security, take it down to Kinko's and make 100,000 copies when nobody is looking, mail them off with a rubber stamp I "borrowed" from behind the counter when the grunt took a bathroom break, and then sneak out before he comes back, without paying. I have them all addressed to a bunch of addresses I found in a dumpster somewhere that may or may not be senior citizens, and figure that at least some will hit their mark and benefit my cause. Most will be ignored because they're mistargetted, but it doesn't matter to me because it didn't cost me anything. It cost Kinko's to make and mail the copies, and it gives the AARP a headache when people start calling complaining about this junk mail that's a lie.

Now, the fact that I lied in the message (common in spam) probably constitutes fraud on its own, but that's harder to prosecute than the much more obvious theft from Kinko's and impersonation of the AARP. That's what's going on in this case, and whether you think the guy has a right to spam or not, he certainly does not have a right to steal someone else's resources or impersonate another party.

Laws?

[sh0gun]

Don't you think it is about time that the government makes some formal laws related to "hacking" and other computer activities. It always seems that lately whenever someone is caught the penalty is never known. I think the federal government should look into Computer Crime seriously and determine what the penalty is. It would be unfair if someone got punished more then someone else just because one judge thought spamming was more serious then another judge. I think this is another case of technology passing up society. With cyber crime becoming more and more common a lot of people do not know what to do with the criminals.
>neotope

More spam problems

[the_tsi]

Has anyone noticed that Sam Khuri/Benchmark Print Supply has been sending out Spam under a new company name, despite (or 'to spite') court rulings against him? I recently received several spams with the same "800 number" but no company name, and then more recently I've seen them with other company names.

-Chris
...More Powerful than Otto Preminger...

Actually, spam IS a crime

[Galvatron]

Commercial email is required to have a real, working unsubscribe link, just as telemarketers have to stop calling if you tell them to take you off their lists. So yeah, most of that spam actually is against the law.

Spam Removal 101

[bahtama]

Email is a whole other ballpark, but to get rid of those phone calls, mail, etc is fairly easy. It will take about a year, but one day you will open up your mailbox and see JUST your important (do bills count?) mail in it. I remember the first day I saw no junk mail I almost wet myself. :)

Just keep sending back your junk mail AND get yourself off the direct marketing mailing list.

Go here to be able to create forms with the address already on it. I am not sure how other countries can do it, but I used this site and I get only a few pieces of junk a week now. Also, Junk Busters is good, but the other site is easier to use.

=-=-=-=-=
"Do you hear the Slashdotters sing,

Re:But an open relay is the right thing to do

[Tackhead]

> If someone stole my car and ran someone over with it, is that my responsibility too? What if I left the doors unlocked and the keys in the ignition? Have I committed a crime? I think not.

s/car/gun/g

s/ran someone over/drove away with the child I was babysitting but left in the back seat when I went to the store/g

People have been charged for precisely those kinds of irresponsibility.

(I'm not advocating criminal charges against admins of open relays - just pointing out that there's plenty of legal precedent for the moral tenet that one should take responsibility to see that one's property is not abused to the detriment of third parties.)

Instead of Jail...

[Auckerman]

He should get 7 years of trying to secure an Windows computer...that ought to teach him...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Prison??

[Wolfier]

The following is my logic. I'm not sure if it is right, but it can make sense.

How many % of (let's say) US citizens are criminals?

(From now on, I'm assuming the answer to the above question is less than a few percent)

If this % is small, how economic is building jails, hiring polices, putting people on trial, etc. to just correct this minority?

Does the correction of this 2-5% of the whole population actually make a significant difference to the sanity of the society?

On the other hand, the system as a prevention tool makes economical sense, because it purports to keep the rest (i.e. 90% or more) of the population from committing crimes.

A thought experiment: imagine that, you see the news on your local TV channel that "for the next 3 days our local police department is going on a strike. There'll be no street patrol..."

Will you get nervous about the news? Then, think about *why* think you'll get nervous. It likely will point to the crime prevention function of the system.

>Reduce the incentive for murder. Why are people
>murdered? There are many social ills that drive
>people to kill. Try to correct these things, and
>you've prevented more murders than sending >someone to jail--where they get angry, lift
>weights, and prepare for their next crime spree

Yes. Sound in theory. Extremely difficult for practice. Murderers kill people for various reasons, some of which totally out of any stretch of our imagination.

It is not possible to make everyone happy at the same time over a series of many government decisions. Some must be upset, for individual reasons. If we cannot take care of each of them, there're bound to be criminals.

e.g. free food for everybody would definitely make a lot of people happy, and prevents helluva lot of crimes. However, it may create a riot among shareholders of big food companies.

Re:Uh, doubtful

[IngramJames]

Oh yeah, and we also need real training for the people who leave their bleeding SMTP servers open for relaying to the whole damn world, or leave their wallets on the bar while they go to the bathroom.
---------------------------

Re:Uh, doubtful

[fatphil]

Cobblers.

http://www.2600.org/law/bernie.html

Read it all.

Re:Heh. After 7 years in the slammer...

[electricmonk]

I think millions of mail system administrators and mail users everywhere have just been avenged...

*sigh*... You and other system administrators wouldn't have to worry about getting vengence on spammers in the first place if you use an MTA like PostFix or qmail. They're a lot easier to configure to filter out all the crap. They're pretty secure, too.

You Dream of a Utopia

[dmatos]

Or is it an utopia?

We will never get rid of spammers. We will never get rid of telemarketers. We will never get rid of Jehova's Witnesses. We will never get rid of television commercials.

I'm afraid that you may just have to swallow the fact that this isn't a perfect world and we must do what we can to protect ourselves. I could be a bastard here and extend your line of thought to home security (why should I have to buy a door lock?), but I won't. Oops. Sorry.

But an open relay is the right thing to do

[bluGill]

There is a big difference between what is right and what we do. When I left my house this morning I locked the door behind me. The right thing to do however would be to leave the door unlocked so that if my neighbor ran out of sugar in her baking she could walk in and get it. I know she will return the favor next time I'm short and egg for my morning omlet.

An open mail server is likewise a nice thing to provide for those people who have unreliable internet connections. I temparly store mail on your server until my buddy gets online, and then you send it while my server is offline.

Trust for your fellow man should be the normal way of dealing with things. Locks should be to prevent kids from playing with balsting caps, not to keep theives out. Fraud and abuse should be completely unknown.

No I agree admins should lock down their mail servers. However everyone should feel very bas about having to do it. Locking down a mail server says bad things about socity.

Re:But an open relay is the right thing to do

[Winged Cat]

Reply or moderate...reply or moderate...

The right thing to do however would be to leave the door unlocked so that if my neighbor ran out of sugar in her baking she could walk in and get it.

Nope. The right thing to do would be to give your neighbor, and anyone else you trust, a key to your house. It has been mathematically proven that "trust always" and "never trust" are not optimal solutions to a wide variety of Real Life cases, at least where they can be reduced to math (for instance, Prisoner's Dillema). "Trust but verify" isn't just a catchy name for an algorithm in some abstract case; it works quite well in the real world. Assuming the common assumption that what works best in the long term is morally correct (that being how history tends to be written), why should anyone feel bad about doing what works?

Re:Antisocial?

[ichimunki]

I completely agree with you, I just wanted to inject a bit of anti-rabid-spammer-hating into the discussion, since rabid anything usually results in faster than desirable erosion of civil liberties (witness the rabid fear of drugs destroying our society and the effect of the so-called War on Drugs). I do think that criminal cases related to computer crimes are going to be a case of "the big guy is always right." so that we will continue to see people like Randal Schwartz and Emmanual Goldstein get whatever legal treatment the law department of a large company decides they should get.

No -- this is wonderful news!

[Cardhore]

Did you read the article? Jason Garon, 46, allegedly sent millions of unsolicited e-mails, better known as "spam" messages, to America Online subscribers.

The government should be congratulating him, not imprisoning him!

Proportional Response?

[weston]

I agree with the other posts that have said that 7 years in jail seems a bit over the top, especially considering that many of us endorse white hat hacking. Maybe even grey hat.

I think computer security law should reflect physical security law, and provide for different kinds of crime. As far as I know, neither "trespassing" nor "breaking and entering" land you seven years in the slammer.

Now, using a mail server to send unauthorized resource wasting mail is probably a crime. Taking someone's car for a spin w/o permission or pirating airwaves on a spectrum allocated to someone else are probably comparable law breaking actions (if you disagree, find something closer). Is 7 years in jail a crime fitting punishment?

There's different grades of trespassing and use of others property. Computer law should reflect this as well.

Re:Proportional Response?

[dsplat]

There's different grades of trespassing and use of others property. Computer law should reflect this as well.

This is an excellent point. I used to argue that the difference between murder and attempted murder should merely be considered to be good luck on the part of the victim and not a difference in sentencing. Then I read this book. David Friedman makes good arguments for different punishments for different crimes.

The major problem with making the penalties too severe is that it encourages additional crimes in an attempt to destroy the evidence or evade capture. To use this particular case as an example, if the penalty of grossly misusing someone's server is roughly the same as the penalty for completely destroying all of the data on it, it gives the criminal an incentive to wipe the system when he's done with it to be sure that no footprints are left behind.

What about the admin??!!??

[garett_spencley]

If I ask to use your gun so I can go shoot someone and you say "Sure", I go shoot someone we're both in jail.

It's not like this guy cracked a root shell and used /usr/lib/sendmail to send the mail. He connected remotely to port 25 on this system and did this. The admin is partly at fault! The admin said "Sure take my gun and start shooting people."

Also I agree with other people that 7 years is an awful lot too. It's not like he was killing people. Murderers and rapists don't get that much time usually anyway....

And no I'm not defending him. I think he should do SOME time. But he should get 7 years when rapists get life. And the admin should at LEAST get fired.

--
Garett

Re:What about the admin??!!??

[Fnkmaster]

A better analogy would be if I left my tractor in the shed with a key in it and the shed door open, and you walked into the shed, took my tractor and ran somebody over with it. A tractor is an agricultural tool that can be used to kill somebody. An mail server is a communications tool that can be used to spam someone. A gun is primarily a tool for damaging or destroying things, which could be targets or could be people, but generally they were invented to kill. Email was not made to spam.

Re:Relaying

[mpe]

I suppose with the demise of UUCP mail (cue for someone with a ! in their email address to pipe up), and the increased connectivity of the internet, no-one really needs to relay email any more.

Even if someone was connected by UUCP you probably couldn't tell from the mail address.
On a UUCP set up you can't assume that connections will be made in real time also there is no equivalent of DNS. Instead UUCP "maps" were propergated as news postings.

Relaying

[Anoriymous Coward]

I suppose with the demise of UUCP mail (cue for someone with a ! in their email address to pipe up), and the increased connectivity of the internet, no-one really needs to relay email any more. I still think it's sad that this has to be done. After all, no-one is complaining that having open mailboxes outside every post office is a security problem, yet this is the exact real-world analogy (allowing for differences in sender-pays versus recipient-pays).

I think the sympathies here on /. are clear cut. If the guy had hacked in and left the sysadmin a note how he did it, he should walk away. But because he was using the machine for spam (not to be confused with SPAM) he should be hanged, drawn & quartered. And that's only because we're feeling nice. It's the difference between finding a back of US mail & returning it to the Post Office, or filling it with postage-due credit card scams.

7 *YEARS* ?

[Moderation abuser]

You don't even get that for *murder* in America these days.

You wanna stop being spammed? Use Spamido techniques:
http://www.yelm.freeserve.co.uk/spamido/

what next...

[hugg]

So can I go to jail for 7 years for hacking a Quake server?

Newsflash - YOU pay for them to sit in jail

[w00ly_mammoth]

I agree. People who get carried away with lines like "lock them up and throw away the key" often forget one important question - which is, who pays for it?

It costs over $50,000 a year to keep someone in prison, which is something like twice the average income. Now, why should I pay for someone to sit in a square box and rot away, possibly be abused and develop mental problems of a sexual nature, and then be released into society with no skills? Just because revenge feels good?

Countries that have get-tough-on-crime policies have worse crime rates and a fucked up society. The US has the largest prison population in the developed world, larger than some european nations put together.

I've lived in other countries with different approaches to crime. The ones that focus on lighter sentences + rehabilitation have lower crime rates and less expensive prison systems. Of course, they also don't have electorates that fall for catchy soundbites like 3 strikes and you're out.

Ah, the analogy game!

[guran]

I'd say he just purchased a HouseKeeper (TM pend) marketed as "all you need to run a home"
One of the features of HouseKeeper is to be able to fetch various items from the household for a person requesting it.
As a default, HouseKeeper is configured to fetch anything for anyone. At page 384 in the manual there are (slightly outdated) instructions on how to restrict access to that functionality, for example set it to refuse to fetch the gun for anybody but you, but happliy lend a neighbour a cup of sugar.

Now due to either a bug in HouseKeeper, a faulty manual or negligence, the owner failed to restrict anonymous access to the fetch(gun) command. This, luckily, did not result in a killing spree, but "only" in some late night target practice, which caused considerable irritation for a lot of people and a lot of work patching bullet holes the following day.

Antisocial?

[thinthief]

I agree.

However, is the guy who gets 20 years for pot possession also a danger to society?

The justice system is set up to punish the lower classes and minorities more, regardless or the circumstanses of the crime.

Arn't the guys who run S&L scams and threaten the whole economy doing a lot more damage than those who steal cars or just happen to be carry enough drugs to get counted as a dealer?

You Has Mail!

[ackthpt]

From: Janet_Reno@us.doj.gov
To: LtBurrito@slashdot.org
Re: Take Time Off From The Daily Grind! Learn How!

Don't delete this email until after you've read it And then you won't at all. Guarranteed system means you will never have to work another day! You'll be going places in no time! You will be waited upon by servants, have people bending over to please you, live in an enormous house wear jewelry and be chauffered everywhere you go!

Call 1-800-555-1212 and ask for information!

To jail, to court, to jail, to prison...
Specifically, civil servants, i.e. prison guards
Or visa-versa
Also known as the Big House
Bracelets anyway
By a guard named Elmo

--

more than one kind of right

[mvc]

It seems to me that you're both right, because you're using the word 'right' in two different ways.

When the original poster referred to "the right thing to do", he meant the thing that would be right in an ideal situation. And he was right about this. If I could trust the world with it, I'd much rather give everyone open access to any part of my computer that wasn't specifically private (personal email, etc.) or reserved for something else (say, 2G of disk space that look free, but that I need for the BeOS installation I'm planning). In the absence of misuse (like spamming), an internet of open systems could be used far more efficiently than an internet of closed systems.

On the other hand, you're talking about what's right given the conditions of the real world. This is also a useful thing to consider--indeed, as the original poster seemed to acknowledge (remember, he does lock his house each morning), this is what should guide how we actually behave. When people act as though they're living in an ideal situation, they usually end up hurting themselves and others.

The reason that it's still useful to think about an ideal situation--always remembering that we live in the real world--is that it gives us an absolute standard for how good things could get. If we aren't reaching that standard, we can keep looking for ways to improve the situation.

Just to make things (a tiny bit) more concrete, consider the example of the Prisoner's Dilemma. Ideally, the best strategy should be 'trust always'--if everyone can be trusted to follow this strategy, the total score in the game will be as high as it possibly can[1]. In a random population of different strategies, though, 'trust always' fails miserably. 'Tit for tat' does quite well--probably better than any other general strategy--but still doesn't quite live up to the ideal. The reason to keep the ideal in mind is that it reminds us to keep trying to refine the 'tit for tat' strategy, even though it does better than everything else around, until it can do as well as the ideal of 'universal trust everyone'.[2]

[1] Assuming I'm remembering the scoring correctly. If one player cooperates and the other defects, the sum of their scores is less than it would be if they both cooperated, right?

[2] Such improvements are possible--just not through a change in general strategy. One solution would be to ensure that 'tit for tat' is as widespread in the population as possible. Another would be to change your strategy based on the previous performance of your opponent.

P.S. I've just been reading Dawkins's The Selfish Gene, and I think it's colored how I talk about the Prisoner's Dilemma--anyway, I don't think this talk of 'populations' is natural to game theory. But I hope my point is clear enough, anyway. ;)

--Moss

Re:Relaying and Postal Terrorism

[billstewart]

That's specifically because Ted Kascynski the Unibomber was mailing people bombs, and the Feds wanted to discourage that. (You can argue how much "discourage" means "make difficult" and how much it means "promote the anti-civil-rights propaganda campaign that doesn't let us fly on airlines without showing government-approved permission to travel", but either way....).

More precisely, you can only mailbox packages up to 16 ounces, or 454 grams for you non-Yankees; if you've got a heavier package than that, you have to either go to a US Postal Service window or use a competing package carrier like Fedex or DHL.

Poor analogy.

[iamsure]

Thats a REALLY bad analogy.

More accurate would be, I left my gun in my house. You then went into my unlocked house grabbed my gun, and went and shot someone.

I am guilty of negilgence ONLY if you *should* have had access to my house.

However, you clearly werent meant to be in my house, I never gave you permission to be in my house, I simply forgot to look the door.

THAT is how the law works, no matter how unfair you may think that is.

Prison??

[Stiletto]

Maybe I am offtopic but...

No one likes spammers, and truly I think if convicted they should really lose their internet privileges, but PRISON?

This is evidence of a judicial system that is more about revenge than correction.

PRISON is for keeping violent people from hurting the rest of society. PRISON is for people who must be physically restrained. In the US, we send more non-violent offenders to prison than most other countries. Should you go to jail if you are caught speeding on the highway? How about jay-walking? Why do we send SOME non-violent criminals to prison and not others?

Re:Prison??

[Stiletto]

You're mislead. It is not about revenge. It is about PREVENTION.

I'm not sure if I agree with that. I don't have any studies to back my theories up so I wont ask for any from you, but I kind of doubt that there really is anywhere (at least in the US) that harsher punishments have conclusively resulted in lower crime rates. Harsher punishments tend to just make criminals meaner, and turn non-violent criminals into violent criminals.

If murderers are just "corrected" without lowering their overall happiness, hell sure many more people will get killed everyday.

Reduce the incentive for murder. Why are people murdered? There are many social ills that drive people to kill. Try to correct these things, and you've prevented more murders than sending someone to jail--where they get angry, lift weights, and prepare for their next crime spree.

"the system is about correction" is bull. Show me how you can make correction on some dedicated criminals without making them suffer, either monetarily, physically or mentally.

When dealing with rational people your argument makes sense. Unfortunately the truth is people are not rational. Criminals are released from jail, and are now more angry, bitter, and socially inept than before they went in, because there is nothing for one to do in jail than sit around getting angry and working out.

If you're going to put someone in jail, make it for life, because they will sure be hell-bent on being a criminal when they come out.

Re:Prison??

[gunner800]

PRISON is for keeping violent people from hurting the rest of society.

Not everyone would agree.

In the US, we send more non-violent offenders to prison than most other countries.

There, proof that not everyone agrees about what PRISON is for.

Why do we send SOME non-violent criminals to prison and not others?

Because not all non-violent crimes are equivalent. Jay-walking is not equivalent to forgery, just as rape is not equivalent to murder.

The fact that some crimes do not justify prison time does not prove than no crimes justify prison time.


My mom is not a Karma whore!

Re:Huh?

[TheCarp]

In theory the whole point of a jail is not just containment, but to "reform" a person so that they can be let out and once again become a productive member of society. However, the only real effect that jails have is mixing criminals together and leaving them worst off, and more likely to commit crimes when they get out than ever before.

Quite frankly, I want to know... how do you translate some monetary amount of damage, or loss of life into "X years"? How is this "crime" worth 5 years of a persons life, and this other crime 10? How do you make that translation?

I think throwing a person in a cage is an EXTREMELY HARSH punishment, any way you slice it. As such I think the use of such a punishment should be weighed very heavily.

> As for stopping it by removing any "profit"
> incentives, profit is not merely monetary.

No its not, but in many cases it is. In this case it is. People don't spam for the fun of it. They don't spam to annoy people. They spam because it is profitable. They spam because its free advertising for whatever their money making scheme is.

Do coke and heroin dealers cut their product with everything from baking soda to lidocain because they LIKE seeing people take impure drugs? Hell no...they do it because it increases their profit margin. It takes their product, which is worth
more by weight than gold, and raises its return
on investment even more.

Spammers are the same thing, people who know how they can make money, and are doing it. Its free advertising man. Or for the more "sophistocated" ones, its free advertising that they are selling to someone else. Not just stolen network and CpU resources, but stolen and sold.

Do you really think that criminals comit crimes "because they are bad people"? Ive known people who were "criminals" in their past, made their money stealing and cheating. They weren't "bad people", they were people doing what they knew how to do because they could make more money doing that than any legitimate job that they were qualified for.

If you take away the profit motive, then the few trouble makers who like hurting people aside, you force them to look towards legitimate work. The vast majority of the problem goes away.

Frankly there would be a hell of alot more trolls on slashdot if one could make money by trolling.

-Steve

Okay,

[Galvatron]

I guess you're entitled to your opinion, but this kind of attitude strikes me as incredibly insensitive. It's tough to get good at computer security, and new exploits are discovered all the time. It's easy to forget to close a window. One should always take whatever steps possible to protect oneself, but that doesn't make the criminal any less evil for taking advantage of someone who did an imperfect job of it.

Re:7 Years?

[fishbowl]

I've read no less than 10 messages here stating
that "rapists and murderers" get less than 7 years.

I think you'll have a hard time finding a "murderer" whose original sentence was less,
or even a jurisdiction that allows such a sentence.

PopLaunch

[update()]

On the subject of spam, are people familiar with PopLaunch? I just got one of these today, filled with innocent URL's in fake F0RM tags. Is the main linked URL real? I was really pissed off by this and would like to make sure I nail the guy behind it.

Here's a FAQ on the subject by a company that has the misfortune to make a product with the same name.

So an SEC investigation of the VA Systems IPO isn't News For Nerds? ;-)

7 years for spamming?

[SpinyNorman]

Hell, it'd be nice to see people serve 7 years for murder

For spamming it'd be more appropriate to give them a large fine and temporarily ban them from any computer career (a la Mitnik).

Re:7 years for spamming?

[TheGratefulNet]

actually, it would be more fitting to force them to serve on an ISP and take all the angry calls/mails from net.abused subscribers.

7 yrs is too harsh. make the punishment fit the crime. give this turkey an appreciation of why its bad to spam.

how about this: force him to have to read all of slashdot, every day, browsing at -1 to 1.

--

Re:Not Seven Years for Forgery

[ackthpt]

Oh, I dunno about this. I'm no legal scholar, but simply the act of forgery is probably not sufficient grounds to send this guy to prison for 7 years. Doing it it with malice or with clear intent to commit fraud, while tresspassing. Common sense says: Go to Jail, Go Directly To Jail.

--

Re:Huh?

[TheCarp]

My point was that these same people, if the profit motive is taken away, if they CAN'T profit by doing bad things - then they wont do them.

People don't spam, steal cars, or break into houses because they like doing it (ok, some punk ass kids steal cars for the purpose of joy riding and such... same goes for things like vandalism, but thats about the extent of it). They do it because they can profit by it.

Putting them in prison? what does it solve? When they come out they are just as unskilled as when they started. Still, ALL they know how to do is steal. They are put back on the street, worst off than they began.

Fuck prisons. They solve nothing. You want to get rid of the crime, make sure they don't profit by it. Make sure they don't make a dime off their spam or stealing, and then give them options for how to better themselves.

Your not going to reform a theif by slapping them on the wrist and saying "No, bad". You need to teach them how to get it in the socially acceptable and productive manner. How to earn it.
otherwise, when they get out, still all they know how to do is exactly what they were in for in the first place.

I think the real crime is the cost of living in our society. Its insane. I work a pretty good job as a sysadmin. I don't make top dollar, and am not interested in doing so. However, my budget gets tight! After rent and bills, I really don't end up with too terribly much...but I still live a comfortable life.

I have known people who work unskilled labor jobs. They don't make anywhere near what I do. Constantly struggling to keep their head above water. Working long hours, and ending up with nothing to show for it... just the bare minimums of a roof over their head and hopefully enough gas in the car that they can't really afford but can't get to work without.

At least where I am (Boston area) the cost of living is horrendous. It is, in and of itself, a crime. And people wonder why there are tehives and drug dealers. I wonder why there aren't more of them!

A good friend of mine did alot of bad things in his youth. I know he knows how to steal a car. He has come to me in the past for the consolation... cuz he works 80 hours a week, works his fingers to the bone. Can barely make rent half the time.

He knows he could steal a few cars and make some quick cash, pay that rent and make the car payment and still leave him with plenty of leisure time. He wont do it, cuz he knows its wrong - he doesn't want to go back down that path. Can you imagine the temptation? How many others are there like him?

Its alot easier to talk about morals and "bad people who steal" when you know where you rnext meal is comming from and that your going to have a roof over your head next month.

Do I think its ok to steal? Hell no. Its not. However, I don't think that stealing is the problem. I think its the symptom. Its a symptom of a larger problem. A social and economic one. I don't think putting people in jail or "Making examples of them" is going to solve anything at all. I don't think it reforms people. I think it does simple dis-service to our entire society.

Even if we had a system where by every persons needs were taken care of (and food, water, and shelter arn't the only needs, I count free time to persue a life outside of work is a fundamental need) we will still have stealing and crime... tehere will always be those few who do "bad things" just because they like it... fine, when we have such a system - put them in jail. For anyone else, jail does more harm than good.

For whatever else they may have done, they are still human beings. Hell, I don't even like the idea of holding animals in cages without a good reason. (not to open another can of worms but yes, I think medical testing is a good reason)

-Steve

Re:7 YEARS???

[TheCarp]

I agree and disagree.

I agree that its sad that people are punished less for rape than for fraud. However, I will not agree that this is too harsh of a punishment for fraud.

> How would you like it if a hacker got 7 years
> for breaking into a computer system?

Its not about breaking in. Its about exploiting a flaw for personal gain. Its about breaking in thousands upon thousands of times over and over and using it to promote your own financial gain.

A person who "hijacks" a system once to demonstrate that it CAN be done, and makes a point to not hurt anyone in doing it - has done little wrong in my book. Simple tresspass maybe, perhaps foolish, but nothing truely and fundamentally evil.

A person who "hijacks" a system directly for the purpose of furthering their own personal goals and to assign the blame away from himself? a Person who "hijacks" a system specifically for the purpose of committing FRAUD. This is much worst than the simple act of "tresspass".

I am sorry but... if its new and original, or if its done to demonstrate the possibility or just to learn about the system and to teach oneself what can be done...that is hacking. Just taking a well known problam and pounding it to death because you can or using it for personal gain, that is not hacking, its exploitation.

-Steve

Comment removed

[account_deleted]

Comment removed based on user account deletion