NY AG Sues MonsterHut Over Marketing Spam

Ian Hill writes: "This BBC article tells how NY State Attorney Elliot Spitzer has sued marketing firm MonsterHut.com over "millions" of unsolicited e-mails. He claims MonsterHut.com falsely told its clients that e-mails sent on their behalf were sent to addresses who registered themselves as interested parties. Also at question is how exactly these addresses were collected." eviljim adds a link to a press release from New York's Attorney General and a reminder of how MonsterHut was disconnected from their ISP.

Comments

Good - Make SPAM cost the spammer

[stoolpigeon]

It is about time some of the cost associated w/spam got moved to the spammer. More of this can only be a good thing. If it gets too expensive, maybe it will slow down.

I do worry though about legal remedies just moving the problem to where the laws don't exist.

.

Re:Good - Make SPAM cost the spammer

[Dimensio]

I do worry though about legal remedies just moving the problem to where the laws don't exist.

So do I. Unfortunately I don't think that the proper solution, vigilantism (stringing up spammers, beating and killing them brutally) will be smiled upon by the courts.

Re:Good - Make SPAM cost the spammer

[Dimensio]

I'm an advocate of the "bullet to the brain of the spammer" removal request method myself. We just need laws to make it legal.

I've lost important e-mails because they got mixed up in a big mess of junk e-mail. I want to personally beat to death the sender of every junk e-mail I've received...well, not beat them to death. Just beat them until they're barely conscious then set them on fire.

Re:Good - Make SPAM cost the spammer

[adamjaskie]

If Comcast starts charging me by amount downloaded per month, or even just limits me to a cetain amount, I will attempt to sue spammers based on the amount of bandwidth I end up using to download their crap. That will cost per email. Class action anyone?

Re:Good - Make SPAM cost the spammer

[btellier]

How many times have you been up at 5am watching one of those goddamn Make Millions In Months info-mercials? Many of those stupid programs are merely spam factories. Those "millions of _eager_ consumers waiting for you to show you your product" DON'T GIVE A SHIT ABOUT YOUR PENIS PILL. We need to shut these people down FIRST. Get at the root of the problem, otherwise Joe Sixpack is still going to think it's OK to bother his friends and neighbors with claims of penises the size of trash cans.

Re:Good - Make SPAM cost the spammer

[darkonc]

The infomercials about growing your penis are paid for by the advertisers. It also doesn't cost you anything to receive them. -- and you can program your TIvo to skip over them late at night (when most of them are on).

I have no problem with the infomercials, because they don't pretend to be anything else, and they don't fill up my mailbox, and they don't cost me more than the cost the person who paid to put them on the TV station.

Besides, if you actually sit up at 5AM watching one of those things, then you obviously don't have anything better to do, so they're providing you a service .. (at the very least, they're helping to pay the TV station for the costs of broadcasting 'buffy'.)

Re:Good - Make SPAM cost the spammer

[zbuffered]

SPAM is the equivalent of your TIVO recording infomercials for you. You can delete them if you want, but they still take up space, and you didn't ask for them.

Re:Good - Make SPAM cost the spammer

[Skuld-Chan]

Why not go after the guy who wrote nimda/code red and its varients? I've found that I receive over 100 megs of http requests (for files inside /winnt) daily from zombied windows boxes.

Re:Good - Make SPAM cost the spammer

[realdpk]

Not quite. Infomercials help pay for the TV and cable channels being broadcast. E-mail spam costs both you and your ISP time and money (respectively? probably.)

Re:Good - Make SPAM cost the spammer

[darkonc]

It would be spam if they managed to convince your TIVO to spuriously record them for you. ---

On the other hand, it's not spam if you willingly opted in to some 'free service for ads' scheme. Similarly, the ads on /. aren't spam because I willfully came to the site, and they just happen to be here (and well paid-for, one would hope).

Re:Good - Make SPAM cost the spammer

[sik puppy]

I work in television engineering

Those infomercials in a major marked (SF, LA, NY, Chi) cost $3k to $5k PER RUN! and they keep running them. If they weren't making money they wouldn't keep paying to run them. Makes you wonder just how many morons are in the major markets, doesn't it...

Re:Good - Make SPAM cost the spammer

[sik puppy]

Well, if they move off-shore, then they may take the risk of not having personal/consitiutional rights to protect them.

Let them all move to Russia - professional hit men are inexpensive there...

STATE LAWSUIT SEEKS TO END SPAM EMAILS SENT BY NIA

[Anonymous Coward]

STATE LAWSUIT SEEKS TO END SPAM EMAILS SENT BY NIAGARA FALLS COMPANY

Spitzer Says Company Sent More than 500 Million Unsolicited Messages to Consumers

Attorney General Eliot Spitzer today filed a lawsuit against a Niagara Falls-based "spammer" that sent hundreds of millions of emails to consumers whom it falsely claimed had requested the emails.

"Every day New Yorkers are being inundated with unsolicited commercial emails, or spam," Spitzer said. "Some of the spam is a vehicle for fraud, some of the spam is inherently fraudulent, and much of it constitutes a real annoyance for email user. This lawsuit is the next battle in our continuing fight against online fraud, and an attempt to help consumers maintain control of their email in-boxes."

MonsterHut, Inc., its Chief Executive Officer Todd Pelow and its Chief Technical Officer Gary Hartl, are accused of fraudulently advertising and representing the company's email marketing service as "permission based" or "opt-in," meaning that every consumer to whom they send commercial email has explicitly asked to receive it. In fact, the suit alleges, the company's email lists are only partly "opt-in," and include many consumers who never asked to receive email from the company. The suit also alleges that this false representation of MonsterHut's business practices enabled the company to profit through the deception its Internet access provider, its own paid advertisers, and consumers at large.

The suit alleges that since March 2001, MonsterHut has flooded consumers' email in-boxes with more than 500 million commercial emails, advertising a variety of goods and services. At the same time, negative consumer response to MonsterHut's spam has been overwhelming. More than 750,000 consumers have requested to be removed from MonsterHut's mailing lists, and tens of thousands have complained to MonsterHut's internet access provider, PaeTec Communications, Inc., of Rochester.

Earlier this month, PaeTec cut off MonsterHut from its network, after a New York appeals court held that MonsterHut had violated an anti-spamming provision in its contract with PaeTec. However, nothing in that decision prevented MonsterHut from spamming consumers through another internet service provider.
"We are seeking to prevent MonsterHut from continuing its fraudulent, deceptive and illegal practices, not just over PaeTec's network, but over any ISP in New York," Spitzer said.

The Attorney General is seeking a court order to:

• Enjoin MonsterHut, Pelow, and Hartl from falsely representing the nature of their unsolicited commercial email;
• Require MonsterHut, Pelow and Hartl to disclose how it obtained all the consumers' email addresses; and
• Require MonsterHut, Pelow and Hartl to pay civil penalties and court costs for its violations of New York's consumer protection laws.

This case is being handled by Assistant Attorney General Stephen Kline of Attorney General Spitzer's Internet Bureau

SPAM

[coryboehne]

No, not the canned mystery meat, the junk e-mail that clusters my inbox everyday. I really hope this case will set a precedent that will deter the 25 or so people that seem to like to spam my account with their 'earn 10,000 a day', 'make your penis larger', 'diet now, lose 100 lbs a day and get paid $1 a pound', etc. I am truly sick of this shit, and I hope that someone gets the message. Of course the trick is to make this non-profitable, either by suing them blind, or by simply not responding to any of these e-mails. Keep in mind that the only reason that they don't do this via snail mail (aka: USPS) is because it actually costs money to mail a letter via this means, otherwise you would find it necessary to have a mailbox 4' X 4' X 6' and it would still be overflowing after 2 days.

Micropayments

[ldspartan]

It'd be really cool to see mandatory micropayments for UBE - I would be willing to accept the extra load on my mailservers if I know I was making a tenth of a penny per message.

Hell, running an open relay would rapidly go from moronic to profitable :).

--
Phil

Re:Micropayments

[Loki_1929]

Hell, running an open relay would rapidly go from moronic to profitable :).

You're only half right. I would describe this as profitable stupidity - getting paid to be stupid.

The choice is clear and obvious

[Jucius Maximus]

There needs to be a law in the United States outlawing spam.

All the logic is there an the anti-junk-fax laws. It just needs to be applied to e-mail. This way it would be much easier to prosecute groups like monsterhut.

Re:The choice is clear and obvious

[FortKnox]

There are state laws against phone solicitation (Kentucky has a state-wide "No Call List" that if your name is on it and you get a call, they are sued by the state). They just need to make these "No Call Lists" extended to email.

I'm a minority. I don't mind spam as long as it targets me, personally. I don't mind wading through spam about PC games, or cheap computer components. I do mind emails from Jenna and her sorority sisters telling me how they'll get naked if I click this link.

Re:The choice is clear and obvious

[Jucius Maximus]

"yea, but then the spammers just go off-shore to avoid the law."

No problem ... just firewall whatever country permits this behaviour. When those countries get the idea that spam is bad and want to send e-mail to the US, they shut the spammers down and we un-firewall them.

This would crack down the americans spamming through open relays in asia, people who are actually living in other areas to send spam to us. (Do I sound overly xenophobic?)

Re:The choice is clear and obvious

[letxa2000]

I've given up hoping that spammers will go away. They'll be here for quite some time.

That said, I've hacked my sendmail server. It now analyzes mail as it comes in. In addition to the standard blocking of known spammer IP blocks/domains, my sendmail now looks at the stream coming in when the spammer connects to the mail server. Certain conditions/strings are a dead give-away that the incoming mail is spam.

As soon as my SMTP server decides the incoming message is spam, it hangs up cold. No error message, nothing. Just hangs up. Doesn't matter if it comes from an open relay or dial-up, if certain conditions are true, I know it's spam.

My spam count has gone from 30-40 day down to 3-7 per day.

It's actually gratifying to do a tail -f maillog and watch the spammers try, get hung up on, try again, ad nauseum...

Re:The choice is clear and obvious

[rossjudson]

Can you even imagine giving a kid an email account these days? I can't believe I'm actually saying this, but...if I had an 8 year old (which I don't), would I let that child have an email account? No way. Any leakage of that email address could result in my child having horse p0rn after horse p0rn email. And if she checked her email without me having a chance at it first, it could slip through.
We need another email system. We need a system that uses technical solutions to make spam identifiable, early on in the chain. Systems should not relay spam, period. You're either participating in the transparent email relay system or you're not. Email that goes through shadows should be marked as such. We only need a few of the very big guys to provide, as a choice to their users, the ability to opt into the safe email system.
When I receive email on one of my older accounts, the first thing I do is highlight everything, then pick and choose through the subject headers for what's relevant. Usually I'll find two real emails out of about 30.

Re:The choice is clear and obvious

[AndroidCat]

yea, but then the spammers just go off-shore to avoid the law.

Let them. Costa-Rica was a popular spam-haven until the whole country got black-holed in blocking-lists.

Even China and South Korea are slowly getting a clue. Now if only we [tinw] could mallet some sense into UUNET and Verio...

Re:The choice is clear and obvious

[AndroidCat]

"Unfortunately, it's much harder to track down the source of an e-mail than it is the source of a phone call."

Ahh, but what's the point in sending spam if they don't give you a "payload" in the spam of some way to contact them? (email, web-page, phone number, snail mail address, etc) Granted spammers use all sorts of tricks like open relays, proxies, obfuscated URLs, fake headers, etc, but they can't hide forever. Google searches of net.admin.net-abuse.email & sightings can be helpful if someone has already tracked down the spammer.

Re:The choice is clear and obvious

[gorilla]

I think a possible solution would be:

The majority of email goes from people who know each other to other people who know each other. Therefore, if the two people have exchanged email before, then that should be allowed. Of course, if either side decides that they no longer wish to communicate, then they can the other one from their database.

Another section of email is going to people who have not communicated. This should have a paypay like 'deposit', which will be set by the reciever, and if the sender accepts it, then the email will be communicated. When the receiver reads the message, they have the option to either cancel the deposit, or keep it. If you think reading a spam message costs you 25 cents, then you set the depost to that level. On the other hand, if you think it's worth $100, then you set the deposit to that level too. On the sending side, you set a limit where you'll automatically pay the deposit, and any deposits above that will be manually asked for confirmation before sending.

This would require minor changes to the SMTP protocol, to identify the amount of the deposit, the acceptance or rejection of it, and links into accepted Paypal like services.

This way you get to continue to exchange emails with your friends. You charge spammers, and if your aunt Mabel, who got your email address from your mother, happens to email you, you don't charge her.

Criminal Perjury Charges

[Erasmus Darwin]

Personally, I'd like to see perjury charges brought against the individuals who lied under oath ("All our addresses are opt-in. Honest!") in order to obtain the infamous injunction that prevented Paetec from TOSing Monsterhut.

On a sidenote (with regard to the quest for the email address source), it's fairly common knowledge (enough so that Paetec mentioned it somewhere on litigation.paetec.net back when they were soliciting affidavits from spammed parties) that a number of the addresses used came from WHOIS records.

Monster Hut

[tps12]

Monster Hut makes the best monsters. I love their personal pan monsters, and their deep-dish Chicago style monsters, also. Great for parties. The crispy thin-crust monsters are also good, if you like a nice New York style monster. A slice of their leftover monster also makes a great breakfast. I like to order a medium monster with pepperoni and peppers and olives. This is enough to feed me and my girlfriend (who also loves monster), plus leaves a little leftover for the next day.

Cell phone spamming

[FatAlb3rt]

...came to my attention last week when my wife signed up for text messaging for her cell phone. Her plan allows the first 100 messages each month free, with extras for an additional price after that. What happens if (when) that number gets on spam lists it can be sent in the form of an email, ie, cell-number@provider.com? At the rate I get spam in my inbox, surely she'll run over the 100 limit, and it WILL cost me money to receive spam. Surely there's cause for recourse at that point?

Wouldn't be too hard to take the ball and run with this one. Get on the message boards and put your number in your sig. Too bad I don't have the time or resources to do it.

Re:Cell phone spamming

[BagOBones]

That happened to me already.. My account came with e-mail at 10 cents Canadian a message.. but all the e-mail addresses on the network where the same format areacode-phonenumber@companyname so a marketing CO just started randomly e-mailing addresses because they could easily guess valid adressess.. I had to quickly remove the e-mail option from the phone because the charges stated to add up fast... When I asked the phone company if they could block or filter such messages.. they said there was nothing they could do.. I no longer have e-mail on my phone because of stupid SPAMERS!

Re:Cell phone spamming

[nolife]

Most cellular plans in the US charge a fee for messages to a cell phone. This would result in a direct out of pocket expense that the consumer can see every month on thier phone bill. Junk email to your ISP costs money but it is not reflected directly in your monthly bill. Both cost money and resources that the consumer MUST pay for. I have not received SMS or email spam to any of my cell phones yet. When (not if) it starts it will be a royal pain in the a$$ and I will have to cancel the service completely. Laws for spam will not change until the increased cost is directly visible by the consumer.

Re:Cell phone spamming

[darkonc]

Bwaha! There we go.. Time for a class-action lawsuit..

Of course, you'd have to lock down the full text of the email so that you could get the headers to locate the spammers..

TO do that, you'd have to supoena the Phone company .. If you could figure out if the spammers were all the same people, you might be able to get the phone company as a third party (they have LOTS of money to suck in..)

Add in punitive damages, and you've got a real nice class-action suit.

Re:Cell phone spamming

[Skapare]

Your phone company can stop it. Anyone saying otherwise is either lying or stupid. The truth may be that they don't want to stop it. But if enough people cancel out on the e-mail service, that may be hurting them. If there's a competitor phone company that is smarter, it can hurt even more as customers move over to the competitor to get spam-free e-mail.

We need more of this

[RealisticWeb.com]

I hope there is a lot more cracking down on this method of marketing. I've always wondered why it works for them in the first place? Seriously, why do they think that if they keep sending me five copys of the same email EVERYDAY, eventually I will answer? Or why would I answer if they use a completly misleading subject line so that it gets through my filters? They say that they are complying with whatever laws apply by giving you an email address to be removed, but it you mail that, it's either not a valid email, or they just sell your email to others, and you get tons more emails. Obviously some people must answer these emails, but I don't understand how it would ever be worth the cost of thier investment.

Re:We need more of this

[MillionthMonkey]

Seriously, why do they think that if they keep sending me five copys of the same email EVERYDAY, eventually I will answer?

If you didn't reply the first 100 times, maybe you'll reply on the 101st. Remember, a spammer might have paid good money ($0.000001) for your email address and when you don't reply he's forced to eat the loss, damn it. And when you're running a prestigious nonaccredited university, every microdollar counts. So it's quite cost effective to hammer you with the same spam using a hundred different subject lines because someday you might go crazy and decide you do need a larger penis (or that you have a penis to enlarge at all), which would give the poor guy a return on his investment.

Why 5 duplicates? Most of the real money in spam comes from selling your list of addresses, because that's the only thing a spammer has to sell. (It's the only thing he pays for besides the throwaway dialup accounts, cable modems, address harvesting software, and sex, and none of those has a comparable resale value.) A spammer typically runs around buying or stealing all the lists he can find from other spammers, so he can compile them into one big list and resell it to other spammers. He obviously can't be bothered to remove duplicates, because 1. that would require him to use his own computing resources, which is forbidden in the spam business, 2. the guy he bought his lists from didn't bother to remove the duplicates, so why should he remove them from the compiled list he's selling? and 3. when you remove duplicates the list gets shorter and commands a smaller price, so what's the motive in doing it anyway? To avoid pissing off the recipients? Ha, ha, ha, ha. A list of 1,000,000 email addresses in which each address is duplicated 5 times will sell just as easily as a list of 1,000,000 addresses with no duplicates. In fact the difference between "200,000 email addresses!" and "1,000,000 email addresses!" is usually four Control-Vs.

Or why would I answer if they use a completly misleading subject line so that it gets through my filters?

Why would you answer if they used a subject line that doesn't get through your filters?

Re:We need more of this

[AndroidCat]

You gotta wonder what the average lifetime of a spammer is. As in, how long / how often does the typical spammer do his thing? How long till they give up?

A lot of the small-timers give it up pretty quick after they catch a clue-stick upside the head. (There's no end to the suckers who believe that a "marketing" company has real honest "double opt-in" mailing lists. Endless sob-stories on NANAE: "But they promised it was opt-in!") Others linger for a while, jumping from ISP to ISP. And then there's some hardened spammers who have been at since the mid '90's.

Block lists that block ISP ranges are now putting pressure on ISPs to chose between spammers and legitimate customers. Regretable, but it's the only thing that seems to work with clueless / unresponsive / spam-friendly ISPs. (Especially the ones that will hop the spammers around to get past lesser block-lists.)

Re:Spamming

[tomhudson]

there is a difference. At least the people giving you junk mail in your home mailbox had to spend real money. They had to believe enough in their product so that the cost of solicitation would be covered.

But with the cost of email spam (the opportunity cost) being orders of magnitude lower, to the point where it's so close to zero per unit, the "social contract", whereby the one doing the soliciting has made an up-front investment, has been violated.

Oh, by the way, deleting spam on your computer is not free. It takes some of your time, and, even if you were to value your time at the minimum wage, your investment is far higher than the spammers.

Gee - Using EXISTING laws!

[R2.0]

The only thing stopping the AG's and other law enforcement is a lack of imagination, not a lack of laws. If spam is fraud, pursue it as fraud. If someone is violating copyright, go after the individual. How freaking hard is it?

Re:Gee - Using EXISTING laws!

[gatekeep]

You make some good points, but forget some important ones as well. Sure there's lots of existing laws that could apply, but the problem in a lot of cases is tracking down the offenders, and even then there's so many of them that the manpower to prosecute them is ridiculous.

SPAM and internet scams operate on a different scale than anything before. I probably get no less than 150-200 SPAM emails a day. Assuming they all from different senders, and are all fraudulent (which I realize is quite an assumption) let's figure out just how much time/money it would take to prosecute them all. Let's say for arguments sake that it takes 15-20 hours to collect information, and find the person to prosecute in the first place. Then let's suppose there's another 200 man hours involved in bringing this to trial. Including the judge, attorneys, etc this is probably a conservative estimate. Now let's suppose each of the people along the way (two attorneys, judge, technician to collect evidence) are making $40,000 each of taxpayer money, again that's probably conservative. Using the above estimate of 220 man hours per spam, that gives us a cost of $4230. Seems to me that's probably on the low side. Multiply this by the 200 messages a day I'm getting, and WOW $846,153 to prosecute the senders of one days worth of spam for one user. That's a lot of money.

All the laws in the world won't help with this problem. So long as the system is designed to allow the amount of spam that's out there, there's not much laws can do to change it. We need to either change the system so it costs the senders to spread around thousands upon thousands of emails, or find some other way to penalize without involving the already overburdened, underfunded, bureaucratic legal system.

Re:Gee - Using EXISTING laws!

[Stoutlimb]

I think with fraud, one must prove intent. Some spammers can claim ignorance, and then the burden of proof is on the prosecutor to prove otherwise, or else the case gets thrown out. If you make merely the act of spamming illegal, regardless of intent, suddenly that is a non-issue, and prosecuting spammers has become that much easier.

Bork!

Re:Gee - Using EXISTING laws!

[duffbeer703]

You are doing something really stupid, or people who dislike you are putting you on spam lists.

I regularly post to usenet groups and mailing lists with my real address and conduct business online with it as well.

At most, I've received 20 spams in one day. The average is 3-6. 90% of these are caught by filters.

Simply Shocked

[Alien54]

Mr Spitzer's lawsuit against Niagara Falls-based MonsterHut.com accuses it of falsely telling clients that it sent the e-mails with consumers' consent. Under New York state's advertising laws, the company could be ordered to pay a $500 (£342; 538 euros) penalty for each unsolicited message.

I am "simply shocked" that a company would tell such lies to it's customers.

Thank God that we don't know of any other companies that would do something like that.

Re:Simply Shocked

[Anonymous Coward]

MonsterHut ... Jabba the Hut ... same bloodline.

Tricky...

[BrookHarty]

My spam has been going up over the years, using the same email for 5+ years, seems to do it. And Im a busy Internet poster, and active on mailing lists and online BBS boards, so it compounds matters.

Topics lately that have passed my spam filters, "Your Bill", My Name correctly(most spam dont use names, just email addresses), Actual products that I use, (someone must of sold my email address), Mailing list type headers (vnc/linux kernel/etc).

Funny thing, some mailing lists are tagged as spam, like IGN computer news, which I had to tag as good. Spam takes way more of my time than it should. I know for sure, I havnt opt'ed in for anything, and "Opt-Out" is a fucking joke.

Re:Tricky...

[ninewands]

I NEVER get spammed as a result of postings on usenet. I have my newsreader setup up to show my e-mail addy as phony_username@127.0.0.1.

I figure the spammers can clean the trash out of their OWN mailserver's queue, thank you very much.

The way I DO get spammed is from postings to mailing lists and groups on Yahoo, where I don't have any control over the information disclosed in a message's headers. I've stopped doing that. Additionally, I read my mail with KMail which allows me to "bounce" messages from spammers. That usually tells them my address is invalid, even though it's not.

Re:Tricky...

[PD]

Can anyone tell me the origin of that type of address? I have NEVER found a mail server that liked it. For example, here's Exim's error message:

This message was created automatically by mail delivery software (Exim).

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

pppp@127.0.0.1
unrouteable mail domain "127.0.0.1"

So, if it's not a legal address, why do so many think that it is?

Very curious.

Re:Tricky...

[Amazing Quantum Man]

My moz newsreader is setup to give my email address as "no.spam@here.dude"

Re:Tricky...

[gmack]

Because it's legal. "127.0.0.1" is a reserved number that indicates the local machine. It's commonly known as loopback.

So the mailserver tries to send it to itself, realises it's not supposed to recive addresses from there and spits back an error.

If you have control of a nameserver you can make a domain resolve that way and then the spammers can't detect it as easilly.(potentially more fun)

Re:Tricky...

[PD]

That cannot possibly be right. I just send a mail to pppp@localhost and the thing worked just fine. localhost resolves to 127.0.0.1

OK, another test. A mail to slashdot-1@pdrap.org works just fine. (I've blocked that address because spammers found it a while ago). But, a mail to slashdot-1@65.188.39.1 does NOT work.

So, your explanation doesn't fit the observed facts.

What am I missing?

Re:Tricky...

[Maj. Kong]

i think you need brackets -- foo@[127.0.0.1] -- for this to work.

Re:Tricky...

[gmack]

It's a quirk of exim's setup so it's not allowing sends to numeric addresses. Some MTAs will accept it.

Re:Tricky...

[PD]

Thanks, that was the secret.

Re:Tricky...

[darkonc]

My spam has been going up over the years, using the same email for 5+ years, seems to do it. And Im a busy Internet poster, and active on mailing lists and online BBS boards, so it compounds matters.

I've had my email address for a while, but what I do is, once in a while, I go on a hunt-and-kill binge.

I've stopped trying to track down where spams are coming from. I just follow the links to the web sites that they link to and contact the ISP to have them shut down. After each hunt-and-kill binge, my spam seems to quiet down quite nicely.

Spam sources are a bitch to track down, and a dime-a-dozen. On the other hand, spammers need consumers to be able to contact them, and web sites take some work to set up. If you shut down their web sites, it actually costs them money.

Re:Tricky...

[darkonc]

It not going to work for email, but news readers usually allow you to specify anything for your return address.

Besides, chances are you don't want to mislead people as to what your reply address is if you're sending them email

Unless, of course, you're a spammer!

Re:Tricky...

[BrookHarty]

True, I started looking at where the spam is coming from, and I noticed alot of webservers for the opt-out pages are names like, cs-1.foo.bar, h341lp.foo.bar, blblb.cs02.bar, lots of names that are just setup for spam. I think some of them, at least 20% are from the same company, just different domains. The websites for opt-out have the same look too.

I think Ill write a spam tracker, some kind of spam database, track the headers, do an ISP search, state search, and find a nice pattern. Wonder if any of the larger spam black lists do this already. A hit list of spammers ISP.

how to stop spam:

[rizawbone]

Declare the internet the 'land of the free'.

Instead of calling it your 'inbox', it's now your 'american spirit'.

Those dirty emails you send to your wife are now 'vital communications of the heart'.
Your mom nagging you to visit her more often are 'sincere messages from the home front'.

Once we make spam a terrorist act only terrorists will send spam! U-S-A! U-S-A!

Re:Spamming

[Penguinoflight]

Spam on the computer, is generally bad because it's so cheap to send (virtually free). So we end up with tuns of spam. Also, because computer spam is so cheap, it's not at all targeted, for some reason, mail ads tend to be much more interesting.

And, opting out is easy in your mailbox. Just write "Return to sender" on the unopened message, and put it back in your mailbox. The USPO will charge the sender to return it, and the sender will usually abruptly stop. If you want to get nasty, tape the letter to a brick first ;-)

Just a thought...

[Loki_1929]

Would be nice if spam companies such as this who periodically engage in widespread consumer fraud could, by court order, have all assets liquidated and the funds distributed to a state task force designed to root out further spam comanies. If this isn't serving the public, I don't know what is.

Watch that slope (it can get awful slippery)

[FuddChuckles]

Yes, kudos to Mr. Spitzer for finally doing something about spammers. His litigation may make some of the more egregious, mass spammers think twice before trying to force-feed our Inboxes with herbal viagara and penny stocks.

But here is the HOWEVER.

With technology regulation a) not particularly well defined on the books, and b) almost always implemented the *wrong* way (DCMA?), I have little doubt that many legitmate newsletters and mailing lists will get hit by Mr. Spitzer's shrapnel. There are plenty of Attorneys General out there who are not quite so intelligent as sheep (let alone, Mr. Spitzer), and will follow New York's example to the detriment of legitimate mailers.

Damn. Another message for teen sex in my Inbox. Heck, maybe it's worth it....

-FC

Yes!

[macdaddy]

I've had them blacklisted for a couple years now. I wish other states would jump on the bandwagon. These SOBs deserve to pay. They should be forced to read every piece of spam they ever sent out I think. That should keep them occupied for a few life sentences.

Thank god for Elliot

[Anonymous Coward]

I am a New York State resident and I must say that Elliot Spitzer has been nothing short of wonderful when it comes to protecting the consumer.

First it was unsoliticited phone calls (we were one of the first states to set up a no-call list). Now I recieve maybe 1 unsoliticited call every 2-3 months instead of 1 or 2 a day (and at dinner time.... arrrrgggg).

Then it was dissent on the microsoft case. In all likelyhood, New York State served as a keystone for the 9 dissident states.

Now we've got Spitzer battling the evil spam demons. My guess is that once again, Spitzer will come out on top.

Spitzer is a definately a defendant of consumer rights and privacy and has been unwavering in his cause.

my .02

We Can't Stop Spam, so Stop Fraud

[EricHsu]

The main problem with spam is fraud and not its unsolicited nature. Okay, we're all geeks on this bus, so we're angry if we people violate the boundaries of our computer in some unsolicited way (I know it, I feel it too). But there's a difference between getting unsolicited mail from, say someone who's interested in a band you wrote an online review about, and some anonymous mailbot trying to scam you.

The problem is fraud. (1) Spammers forge return-addresses and lie in their subjects to trick you. This makes it hard to weed out unwanted mail. (2) Practically all spam comes from fraudsters. Spam is so despised as a marketing tactic that it cannot be used (openly) regularly by legitimate businesses without them getting a lot of flak.

I hate spam. It drives me crazy. But I believe we will never fully get rid of it, because it makes money. And there may truly be compelling free speech reasons that keep us from banning it (I'm not decided on this point).

But I think three steps would take most of the pain out of spam for me.

1. Spammers who are criminals (stock-pumpers, penis-mightiers) get arrested and deterred/reformed. The NY AG move is a much-needed start.
2. Spam must be given a proper subject like "ADV:", and need a legitimate return address. Violators are subject to large fines and jail.
3. Spammers need to pay for all their bounced mail. Not sure how to enforce this, but it would make me feel better.

Once these things are true, maybe spam will reach the same annoyance level as junk mail in real life: annoying, but not obscene.

Diminishing spam for me

[smnolde]

Since I've added a LART list of IP addresses and domains, per SPEWS, i've seen a nice decrease of UCE coming directly to me.

2002-05-01 09:37:21 recipients refused from [212.90.15.164] (RBL relays.ordb.org)
2002-05-05 07:49:48 recipients refused from [210.76.113.46] (RBL relays.ordb.org)
2002-05-07 00:18:46 recipients refused from cis-ns.careinfo.co.jp [210.226.191.114] (RBL relays.ordb.org)
2002-05-09 02:49:48 recipients refused from [200.24.95.174] (RBL relays.ordb.org)
2002-05-13 13:14:06 refused relay (host) to from H=nat170.63.mpoweredpc.net (none) [142.177.170.63]
2002-05-15 18:06:36 recipients refused from [211.218.38.20] (RBL relays.ordb.org)
2002-05-15 23:36:06 recipients refused from w045.z208037064.nyc-ny.dsl.cnc.net [208.37.64.45] (RBL relays.osirusoft.com)
2002-05-15 23:58:10 recipients refused from [211.174.179.8] (RBL relays.ordb.org)
2002-05-16 20:33:15 recipients refused from [202.164.96.4] (firewall-user) (RBL relays.ordb.org)
2002-05-17 04:01:57 recipients refused from [202.164.96.4] (firewall-user) (RBL relays.ordb.org)
2002-05-18 19:16:22 recipients refused from [210.105.80.65] (RBL relays.osirusoft.com)
2002-05-19 11:36:51 recipients refused from [202.164.96.4] (firewall-user) (RBL relays.ordb.org)
2002-05-21 23:41:55 recipients refused from [202.164.96.4] (RBL relays.ordb.org)
2002-05-24 06:53:23 connection from outmta016.topica.com [64.125.140.225] refused
2002-05-24 06:53:54 connection from outmta016.topica.com [64.125.140.225] refused
2002-05-24 07:41:45 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 08:33:05 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 09:35:23 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 10:46:02 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 12:17:27 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 14:19:49 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 16:23:14 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 19:01:45 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 21:31:16 connection from bso002.topica.com [64.125.140.241] refused
2002-05-25 00:07:19 connection from bso002.topica.com [64.125.140.241] refused
2002-05-25 05:29:37 recipients refused from www.shinohara.com [209.153.61.10] (RBL relays.ordb.org)
2002-05-25 16:22:30 recipients refused from [203.199.213.3] (RBL relays.osirusoft.com)
2002-05-28 04:37:49 recipients refused from h-64-105-76-95.nycmny83.covad.net [64.105.76.95] (RBL relays.ordb.org)
2002-05-29 08:22:41 recipients refused from [211.102.2.131] (RBL relays.ordb.org)

So you can see I'm rejecting mail per relays.osirusoft.com and relays.ordb.org. My LART list is pretty big, too. But that's just for a small mail server.

If you apply similar rules to a multi-hundred or multi-thousand user system, you can really cut down on tons of UCE. Combine it with spamassassin and UCE will almost never get in your inbox.

Spamhaus.org's collection on MonsterHut

[Seth Finkelstein]

There's a great deal of useful information in

Spamhaus.org records about MonsterHut

It includes such gems as

MonsterHut's PR

and

Whine: MonsterHut Letter to Spam Clients

(scroll down - the header index is identical for these links, but the material below is different)

Definitely worth looking over, for a profile of a spammer.

Sig: What Happened To The Censorware Project (censorware.org)

Re:Spamhaus.org's collection on MonsterHut

[psocccer]

(somewhat ot, but funny how someone who is a "master of marketing" yet doesn't even understand 4th grade english)
From the PR link you posted (emphasis mine):

The quality of the design and graphic arts department here at MonsterHut is unsurpassed by no competitor.

So, given the double negative, does that mean that the graphics arts department at MonsterHut is surpassed by all competitors? heh.

No more laws please

[Sell0ut]

What good is governement if they want to govern me? (pennywise)

If we want the government to stop trying to creake things like mandatory age checks before accessing adult material, then we need to stand up and tell them not to create spam laws either.

It is a problem that can be solved technically. We should strive to find better technical solutions instead of finding ways to sue them.

Re:No more laws please

[Zathrus]

Did you even read the article? Hell, did you read the synopsis?

The answer is obviously no.

There's nothing about creating anti-spam laws. It's about prosecuting someone under existing fraud and consumer protection laws.

You want technical solutions? Sure, whatever. They don't work. They'll never work. There will always be open relays out there to abuse, and even if you block them the bandwidth is being consumed. So you haven't solved the problem - you've just masked it.

The only hope is to use existing, rock-solid laws such as those stated above, to prosecute spammers into oblivion. If successful, MonsterHut is facing several billion dollars in fines, and I seriously doubt that the CEO or CTO will be able to hide behind the corporate veil on this one. Push them out of the US and other leading countries and they'll wind up with no bandwidth to do this kind of thing. Then your technical solutions can come to bear - countries without laws? Blackhole them. Then they'll pass laws and throw out the spammers, or relegate themselves to the 19th century.

Government is supposed to look out for it's citizens. This is a fine example of it doing exactly that instead of protecting the corporate entity.

Re:No more laws please

[tester13]

Why not? Supporting some laws and opposing others does not necessarily make us hypocrites.

That is what the system is supposed to provide. A way for people to get governance that they want, and vice versa.

Re:No more laws please

[bluebomber]

In theory, I could operate a "successful" SPAM-sending outfit if I observed the following precautions:

• Don't commit fraud (by sending fraudulent emails).
  
• Don't commit fraud (by lying about the nature of your service).
  
• Don't commit fraud (by lying about the source of your database).
  
• Don't email people in Washington State or Minnesota (the only places I know of offhand with anti-spam laws on the books).
  
• Don't violate my TOS (this could be tough, gotta find a dumb ISP...).
  
• Don't send adult material (just to be on the safe side; don't want to get nailed for sending pr0n to kids).
  

Essentially, I'm safe if I advertise my services as:

SuperSPAMmers, Inc. will send out 100K emails to unsuspecting victims, whose emails we scraped off publicly available websites, as long as the message to be sent is in no way fraudulent or contains adult material.

And the "privacy policy" says nothing about getting off a list or stopping the flow of mail.

...at least according to what was in the article. Doesn't look like there's anything else that they can prosecute.

Re:No more laws please

[darkonc]

There's nothing about creating anti-spam laws. It's about prosecuting someone under existing fraud and consumer protection laws.

I think that this is very good. and it sets a good precident. We don't need more laws to control the garbage that goes on on the internet. We simply need more inventive ways of enforcing the laws that already exist.

Monsterhut should not only be sued for misrepresenting customer consent to recieve the emails -- they should also be sued for misrepresenting where their email came from. Fraudulent headers are just that -- fraudulent. They should be attacked in the same lawsuit, and also prohibited.

Re:No more laws please

[zbuffered]

We don't need laws that give the government any control over the internet, but we need them to be able to prosecute spammers like they prosecute child pornographers, scam artists, or whatever. They don't need to own more of the internet, all they need is our UCE. And a huge pat on the back when they do right by us.

Re:There is one!

[JCMay]

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.

Hey, Coward, this is not a speech issue. It's a property rights issue. I don't get upset about junk mail in my postal mailbox; I don't have to pay for it. The sender pays the postage to have it delivered to me. I just carry it to my trash.

Spam, on the other hand, is often times paid for by the recipient. If you want to play First Amendment with me, I'll play Fifth Amendment with you:

No person shall be held to answer for a capital, or otherwise infamous crime, unless on a presentment or indictment of a Grand Jury, except in cases arising in the land or naval forces, or in the Militia, when in actual service in time of War or public danger; nor shall any person be subject for the same offence to be twice put in jeopardy of life or limb; nor shall be compelled in any criminal case to be a witness against himself, nor be deprived of life, liberty, or property, without due process of law; nor shall private property be taken for public use, without just compensation.

Since you say that Spam is the sender's First Amendment right, it appears that delivery of said spam is "public use," and can't be paid for by the recipient because there's no just compensation. Spammers can't take my money (private property) to deliver your message (public use) without paying me (just compensation) in return for paying for your message's transmittal.

By the same token, you can't use the Freedom of the Press clause-- for the same reason. I can't be forced to pay (private property) for the publication (reception) of spam (public use) without paying me (just compensation).

If they want to pay me to receive their messages, that would be constitutional. As it stands, sending people unsolicited messages that they must pay for is not only not protected speech, but unconstitutional.

Read more about it

Not quite

[macdaddy]

but close. The goal is to make it cost the spammer more to spam than it costs us to litigate.

NY == USA?

[SanLouBlues]

Okay, Niagra Falls is in NY so suing is cool, but 500 million emails to just New Yorkers? Of course if all of the 19 million people (last census) in New York state received an equal number of emails that would make about 25 per person which seems reasonable, but if we extrapolate that same rate to the 280 million in the US they sent about 7.5 billion emails from March last year to April when they were cut off. (Think about it, the extrapolation is reasonable) At a very conservative 1kB per html-email this makes about 7.5 terabytes of data they've sent in a little more than a year. Which makes about 20.5GB of email a day. That seems like a bit much to me.
This is all mental math, so please correct me if you've got the time.

Re:UCE

[Hector73]

uce@ftc.gov [mailto]

i have a yahoo account, get about 5 spam emails a day, and forward most of them right on to the FTC. not sure if they're actually doing anything, but it makes me feel good :)

I do the exact same thing, but I think it actually worked. One company had been spamming me for months (I made the mistake of clicking the "remove me" link). Well, one day I started forwarding my spam to the uce@ftc.gov (and spoofed the 'remove me' link to remove uce@ftc.gov ... buh ah ha). After about a month, the spam stopped. That was two months ago, I have been spam free (for that account, at least) ever since.

I like to think my tax payer dollars actually did some good.

Jurisdiction issues

[hillct]

If the recent internet Libel case goes to verdict, it may impact the power of current anti-spam laws as well. If it turns out that people can be sued for libel in the jurisdiction where internet content is being viewed, it then follows that spammers can be sued for breakage of anti-spam laws in the jurisdiction where the spam is recieved. Only time will tell how this will paly out but there is a silver lining to everythnig, if you look hard enough.

--CTH

Re:Korean Spam

[PigleT]

Two options:

a) man procmailrc, drop it there

b) grep http://www.iana.org/assignments/ipv4-address-space for "APNIC", and refuse connection to all the relevant netblocks.

I do both. I don't get *Korean* spam any more :)

Re:There is one!

[Tackhead]

> Hey, Coward, this is not a speech issue. It's a property rights issue

Amen.

I'll see your Fifth Amendment response, and, I'll raise you a Supreme Court ruling.

"Nothing in the Constitution compels us to listen to or view any unwanted communication, whatever its merit. We categorically reject the argument that a vendor has a right under the Constitution or otherwise to send unwanted material into the home of another. If this prohibition operates to impede the flow of even valid ideas, the answer is that no one has a right to press even 'good' ideas on an unwilling recipient. The asserted right of a mailer, we repeat, stops at the outer boundary of every person's domain."

- Chief Justice Berger, U.S. Supreme Court, Rowan vs. U.S. Post Office Dep't, 397 U.S. 728, May 4, 1970.

A man's home - and his email box - is his castle. Any spammer invoking the First Amendment is full of it.

Attorney General Spitzer, YOU ROCK.

Why not whitelists?

[billtom]

It seems to me that the answer to spam is whitelists. I find I get very little non-spam from people who aren't in my address book (you just have to be diligent about keeping your whitelist up to date).

I realize that some people do have a different email usage pattern and do get lots of mail from new senders, but then you could just use an "ask for confirmation" style whitelist filter.

Is there some reason why whitelists aren't more popular (aside from the fact that it's not the default configuration of Outlook [Express])?

Re:Why not whitelists?

[autechre]

Aside from the reasons mentioned from the above reply, you can also get email from unknown addresses if you're applying for a job. Finding a job is (apparently) difficult enough these days without possibly bouncing email messages from a potential employer.

A nice change in direction

[interstellar_donkey]

For those who inforce the law. It seems as though so much time and energy has been spent as of late in the courts to protect big business (read RIAA) from the actions of people (read us).

It's about time the courts were used, en masse, to protect people (us) from the fradulant actions of business (monsterhut and others).

In a free market, business is supposed to be at the mercy of the consumer. We keep the government around to pass and enforce laws when that does'nt happen. It really does make me feel good to see the NY AG doing it's job.

---

Nope.

[OmniGeek]

I have a Deutsche Telekom cell phone for business trips (it was VERY cheap), and you pay $.16 or so all over Germany for calls you make, and $.05 or so per SMS you send (if I recall correctly, I may be off somewhat); NO charge for incoming anything from anywhere. It is, IMHO, a MUCH better setup than in the US, where I pay for incoming.

I want their servers.....

[TheHawke]

Hmmmm according to Spamhaus their servers were put under lock and key when PaeTec TOSed them. Hmmmm i wunder how much they want for their equipment.. I could use some of their parts, or they could be put to good use in a RTCW or a Q3 extreme server for that matter. :D

Spam Bad- Fake Addresses worse

[fermion]

Unsolicited email is bad, but the problem is proving an email is unsolicited. I am supposedly on some many valid lists it is unbelievable. I have registered a fresh name, used it to complain about an email, and have been told the new registered address was listed on their opt-in list. When I complained to all the various agents, no one did anything.

No, this current approach is a losing battle. What we must have is transparency. The Spammer cannot be allowed to use fake email addresses. I have complained about commercial emails with fake addressee, and the providers refuse to do anything. There must be an opt-out link or email address that is in the same domain as the from and return address. These address must be in the owner domain, and not Yahoo, Hotmail, or whatever free service they use for one time addresses. The subject line must clearly identify the company being advertised. If the email is to a website, the website must have an email link, and, if it is a DBA, must have a link to the corporation or person.

These guidelines will create a proper and honorable two-way communication. There are companies like (I think) Virtual Holdings that cowardly hide behind fake addresses and do not even put a real address on their domain registration. They keep their costs down by hiding behind fraudulent websites that do not have a single method of communicating with the owner. It is the highest form of arrogance that they think they have the right to spam us, but we don't have the right to spam them.

I know it has been said before, but let me say it again. Get a free email account. When you get a spam, especially with a fake email, look up the registration for the websites advertised. Look up the registration for the DNS providers. Send an email to every address you can find stated how cowardly and dishonorable using fake email addresses is. Let them know we know they are vermin. You do not even have to include your own information, as you are complaining about bad netiquette, not Spam.

Re:Spam Bad- Fake Addresses worse

[morgajel]

It's sites like Virtual Holdings that need to be shut down. I completely agree with you. They are *the* villian.

Treat them as such.

I've never supported or encouraged attacking(DoS) people like this, but dammit, someone needs to grab them by the balls and HURT them. figure out a way to run up THEIR bills. track theirs asses down and PROSECUTE THEM. Make it cost too much for them to continue doing what they're doing.

I hope this AG nails monsterhut up by the gonads and not only runs them out of business, but sends the brainchild behind it to jail.

/me deletes another 50 spams out of his account.

bastards.

Re:UCE

[macdaddy]

Better trick, create an auto-forward on your spamtrap addresses that redirects to uce@ftc.gov. Many mass mailers remove .gov addresses now, especially uce@ftc.gov. Trick them with a simple mail alias. Seed that address in the newsgroups and hide it on your webpages with mailto's on non-breaking spaces or transparent 1x1 images. Works like a champ.

Incorrect use

[macdaddy]

Hormel gets pissed if you called unsolicited commercial email "SPAM" because that's their trademark. They have however given their blessing to the use of "spam".

Re:There is one!

[bitchx]

I'll call your ruling:

Ownership does not always mean absolute dominion. The more an owner, for his advantage, opens up his property for use by the public in general, the more do his rights become circumscribed by the statutory and constitutional rights of those who use it.

Not that I think that spam is good, rather the argument that "My mail server is mine, thus spam is illegal" does not follow.

- Justice Black, U.S. Supreme Court, Marsh v. State of Ala., 326 U.S. 501 (1946)

Re:Reality Check...

[Rogerborg]

• This case will have no effect on the SPAM that is currently coming into your e-mail box. Monsterhut is already kaput.

Hmm, maybe he's watched enough slasher films to know that when the bad guy goes down, you keep hitting him. MonsterHut is utterly unrepentent, still assert that their business model is both legal and sound (they actually claim that the court got it wrong), and explicitely intend to start up spamming again as soon as they can slease their way onto another ISP.

While I'm completely ready to agree that Spitzer is probably just showboating and looking for an easy win, I'd be delighted to see a huge fine levied on MonsterHut, regardless of their ability to pay it. The more precedent we get, the better, because every piece of anti-spam case history will make it easier and faster to shut down and sue or fine new spamhausen as they spring up.

The case earlier this month just established that MonsterHut are in the wrong, and let their ISP pull the plug on them. Now we need to assign a suitable punishment, and make sure that we send the message clear and loud: spam is not legitimate, and if you do it, you will pay for it.

Re:There is one!

[macdaddy]

The first amendment doesn't give you the right use my property to excercise your right to run your mouth off. It would be like you coming into my home and and preaching to me in my living room. It's my property and it's not your right to be on or make us of it.

Re:Reality Check...

[toupsie]

The case earlier this month just established that MonsterHut are in the wrong, and let their ISP pull the plug on them. Now we need to assign a suitable punishment, and make sure that we send the message clear and loud: spam is not legitimate, and if you do it, you will pay for it.

This will do nothing to stop SPAM in your mailbox. How is Spitzer going to go after btamail.net.cn? China is going to tell him to take a long walk off a short pier. This is fine if you want revenge but it will not do anything to reduce the flow of SPAM or cause other people to fear doing it.

Geez, I guess the moderators today are Spitzer Democrats. :)

Because...

[schon]

It seems to me that the answer to spam is whitelists. I find I get very little non-spam from people who aren't in my address book (you just have to be diligent about keeping your whitelist up to date).

If a whitelist is the solution, you don't understand the problem.

A whitelist is pretty much like "bolting the barn door after the horses have eaten your children." You're basically just closing your eyes and saying "I don't see it, so therefore it doesn't hurt me."

Spam has two problems, and the concept of a whitelist (or email client "spam filter") only covers one: the nuisance factor (it's a pain in the ass to wade through all this spam.)

The second, much worse, problem is that spam costs the recipient money. Bandwidth isn't free - it costs money.. even if you don't directly pay for bandwidth, your ISP does, so it costs them money, which they charge to you (even if you don't see it broken down in your monthly bill.)

Any client-based anti-spam "solution" (such as your whitelist) is ignoring this: the bandwidth has already been consumed by the spam, so it's already been spent. Rejecting the email AFTER it's been delivered to your server only means that you don't see it - it doesn't mean that you're not paying for it, and THAT is the biggest problem with spam - you're paying for something you don't want.

Re:There is one!

[bitchx]

You don't think that allowing anyone to mail you is making your mailbox "freely accessible and freely used by the public in general?"

Please, leave my infrastructure intact. I'd rather that I get the mail and filter it than have random messages dropped because I couldn't let the public at large email me.

When...

[gfxguy]

the ISPs can't or won't implement those technical solutions, or when they are threatened by lawsuits for doing so.

Re:There is one!

[bear_phillips]

Since I don't give out my email to anyone that shouldn't have it. No it is not "freely accessible and freely used by the public in general".

Re:Conditions/Strings?

[letxa2000]

My conditions/strings expand on a daily basis based on new spam I've received. There will always be some spam that hasn't been seen (by me) that will get through, but I just find something in the spam that no REAL message would reasonably contain. I try to be aggresive, but only within reason. I'd rather let 10 spams go free than kill off one non-spam.

I've been doing this for just the last week and a half. I log every spam that gets disconnected. So far there have been no false positives. The only annoyance has been that others using my mail server that forward me their spam sometimes get disconnected because I've already added a filter that catches what they are reporting. :)

Re:There is one!

[tester13]

I am Familiar with the U.S. Constitution, however you sig makes me wonder if your views are in keeping with modern jurisprudence. Not to engage in political baiting, but it seems you take a very conservative view when it comes to property rights.

To take your point a little further. Why can I not bill for time spent disposing of junk mail? (in addition, materials garbage bags, etc.) What about electricity used to power the doorbell when a solicitor comes?

Spam sucks. However, I am not sure how much resources you are deprived of compared to other previously accepted solicitation norms.

Re:There is one!

[Artifex]

Let me see if I can boil all this down to something smaller:

You have the right to speak; you don't have the right to force people to listen.

Spam wastes my time. If I pay by bandwidth, it wastes my money. At the very least, I have the right to refuse it; at best, I have the right to restitution for damages.

Give me a f***ing break

[flimflam]

1:

One of his more outrageous shakedowns was when he was suing adoption agencies that did not offer abortion services in order to pander to pro-choice voters. Why would an adoption agency want to kill babies?

That would be pretty outrageous if it weren't a complete and utter fabrication. What actually happened was that he sued several "crisis pregnancy centers" for deceptive advertising. They had ads that implied that they performed pregnancy tests and abortions, when if fact they are essentially in the business of persuading women not to have abortions. Under a consent decree they agreed to change their advertising. They didn't have to pay fines, and they certainly were never forced to provide abortion services.

2:
The idea is to deter future instances.

3:
If they violated current anti-fraud law, why not go after them using the existing statute(s)?

4.
No, but he might get something. If not from the company itself, maybe from the officers of the company personally. Also, see 2.

5.
Obviously this only applies to victims in the state of New York.

Now we need to get the California AG a clue

[Animats]

The California Attorney General's office now accepts spam complaints. But you have to print out a PDF form, fill it out, and send it back on paper.

They accept non-spam complaints from a web form, so they know how to do it right. Clearly they're not serious about stopping spam, even though California has a strong anti-spam law, and the courts have ruled that it is valid. There haven't been any high-profile spam cases from the California AG yet.

(There's a legal challenge to the California anti-spam law, but the spammer is losing. The California State Supreme Court recently decided that the California anti-spam law was valid (Ferguson vs. Friendfinder). Friendfinder may still try an appeal to the U.S. Supreme Court. But that has to happen soon, or the decision is final.)

Re:Now we need to get the California AG a clue

[realdpk]

Heh, maybe they just know that they'd get more spam complaints online than they could ever handle. Having submissions come in offline would probably reduce that burden by about 1000x and still cover most spammers.

Stopping Spam...

[slykens]

We're never going to stop spam flat out, but I have started to take an agressive stance against spam during the last few days.

First I grabbed a sendmail access database someone else was using as a base to start my anti-spam efforts from. To this I add domains from which I or a coworker received spam from. One spam and it's done. This list contains more than 9000 domains and IP addresses.

Next I added ordb.org as an RBL. This has helped as well but has also exposed some of our clients as having open relays. I find it interesting to get a call insinuating the problem is with my mail server when the user has not even read the error message. (Which, as you may know, tells them to visit ordb.org to find out what the story is) It is frustrating to explain that I am not going to turn off my RBL because their mail server is incorrectly configured.

I've been using the RBL for about 20 hours off and on and the access database for about two days. So far it has dropped 309 messages intended for a mail server with about 20 users on it.

Re:There is one!

[AndroidCat]

Precidents like, hmm, Paetec v. AOL? AOL blocked the spam at the borders, Paetec sued over "restraint of trade", AOL sued back. Paetec got their asses handed to them, mainly over the private property issue.

There's probably been a few other cases establishing email servers as private property and that's there's no such thing as "the right to email".

The latest blocklists (SPEWS) go after the spamhausen ISP's IP-blocks as well as the spammer's IPs. It's a shame to block non-spammers as well, but they are supporting spam-friendly companies with their money. Hitting the ISPs in the pocket book is the best solution yet, because pin-point IP blocks just didn't work.

Re:But it COULD be fixed.

[zbuffered]

Maybe in 10, 20 years... I hope.

Meanwhile, the cost of this is billions of dollars a year. Lots of /. people don't want laws, because they're afraid of the government getting their dirty paws on us. But what do you propose we do in the meantime? What do you propose we do now? Because despite the fact that you only get ten spams a day, I get about 75. Three months ago I only got 50, and it's only going to get worse.

We have to figure out how to fix this, tomorrow, or we have to ask the government to do it. It has to be fixed. Technical solutions may work, but may doesn't mean jack--they're not working now, and that's all I care about.

If you (the collective you, the people who say "we need a technical solution") can't fix it, STFU. I'm not talking about filtering or RBL lists, I'm talking about putting the spammers out of business. If they're sending spam, your job is not done. And if you can't stop them, again, STFU and let the government take care of it. It has to be done; the costs are too high, and it really gets me worked up.

Until I can post my e-mail address on slashdot without obfuscation and without fear of harvesting, until I can telnet into my POP server and read my mail without getting pissed off, until the primary meaning of Spam is once again spiced ham, you "we need a technical solution" people may not sleep. Billions of $$$ a year.

Re:There is one!

[Tackhead]

> To take your point a little further. Why can I not bill for time spent disposing of junk mail?

In the US, your mailbox doesn't actually belong to you - it belongs to the US Post Office. They allow you to take mail out of it.

I don't like junk mail, but someone's paying the US Post Office to deliver the snail junkmail to mailboxes which are the US Post Office's property. (To be absolutely technical - I think it's something like "you may purchase and own the physical container on the fencepost near the driveway, but the USPS still owns the space within it.")

> (in addition, materials garbage bags, etc.) What about electricity used to power the doorbell when a solicitor comes?

OK, fair enough :)

The (non-property-rights) issue with spam is the one of scale -- junk mail costs money for the sender to deliver. Door-to-door solicitors are throttled by the time/effort that it takes to walk from door to door. Even telemarketers are rate-limited by the number of drones they can have behind the predictive dialers. (Which is we've passed laws to try and combat the use of prerecorded telephone messages. But even these are rate-limited by the time it takes the recording to play back into the victim's voicemail.)

Spam, regrettably, has no such bottleneck. Even if you don't agree that it's theft of the recipient's mailbox, most of it comes through open proxies and open relays -- which clearly qualifies as stealing service from the victimized hosts.

Whether they're stealing very small amounts from millions of victims (the recipients) or larger amounts from a few victims (the bandwidth stolen from unauthorized abuse of intermediate open relays and open proxies) - spammers are thieves.

Courts and Technical Solutions

[davburns]

Spam is a distributed problem, and will require a distributed solution. Courts, law-enforcement, education (social engineering), and technical measures will each chip away at the problem.

Source-based filtering work best when the sources are concentrated and not moving (like when Sanford Wallace was making most of the noise.) This still works a little, and is the premise that all the various RBLs and DNS-BLs are based upon. Content-based filtering works only when the content of the spam is either identical for a large number of victims over time (which is how razor works) or contains patterns that are very unlikely to appear in legitimate email. (Tools like spamassassin work well against these.) If these technical measures against (obvious) spams were effective and universially applied, it would cut down on the volume of spam, but the spammers would get more subtle, and start sending spam that is very hard to detect.

Since most spammers do it only once (but there are a lot of them) it would likely help to educate the public that the spamware-salesmen are essentially con-artists. If it were illegal to send spam, this would be a lot easier. Legal measures alone would likely be unenforcable, because of the sheer numbers of spammers, and the fact that its easier for them to get new accounts and other services than it is to track them down. If I my offer an analogy, this is like people burguling my house. I can stop most of them by putting locks on my front door. For those that are determined enough to defeat those locks, the police will will stop them by sending lots of men and women with guns and handcuffs. It also helps if parents and schools teach their children that it's not right to steal.

Paetec made the mistake...

[Skapare]

Paetec made the mistake of agreeing to contract terms that specified that if 2% (I think that was the figure) of the addresses were found to be non-opt-in, that this would be an acceptable margin of error. Presumably MonsterHut would have removed them from the list if asked. Even in the worst case of assuming that every complaint was one of those non-opt-in addresses, the complaints would have had to reach the level of 2% for Paetec to disconnect them under terms of the contact. It's that contact that allowed MonsterHut to get the injunction. MonsterHut didn't need to say that 100% were opt-in ... it only needed to say that 98% were opt-in, and Paetec didn't have enough numbers to prove that more than 2% were genuinely non-opt-in, at least not initially.

Paetec made some legal blunders. The rest of us can learn from their mistakes. I'll give Paetec the benefit of the doubt for being fooled in this case. A future company will not get that from me.

One step an ISP can do (if they didn't stupidly sign away any rights to do this) is to put the spammer on static IP and set up reverse DNS to name them with the spammer's domain name. Then I can block the spammer without blocking the ISP, regardless of the stupidity of the ISP's lawyers. And this is my common practice ... I block just the spammer if they are in reverse DNS identified static addresses. And I block them by their domain name, so if they move, even to another ISP, they are still blocked. They have to change domain name to evade this (and I'm sure many have).

Also, I do all my anti-spam blocking at the server during the SMTP session. I don't want their spam in my servers, and I don't want rejection notices to sit undelivered for days, either. By stopping spam before the mail is delivered, it doesn't get queued and the sending server has to deal with the rejection (but there is still a rejection in the cases of legitimate mail getting caught so the sender at least knows something happened, and can look for a way around).

Re:Spam is out of hand!

[AndroidCat]

" Extortion?? " Yup. We have found you can easily get off a blacklist with $1000 or more in hand, but if you simply ask to get off the list because you are not a spammer, "Nope. You got on there at some point for something, you must be!" No record check, no records at all. Your business name can be sullied if someone simply puts your URL in a piece of spam. Bribe or no bribe, they don't ask questions of the validity of the argument, but only one way will get you off the list. Not everyone does this, but not all spammers hide their identity or blast millions either.

Horse byproducts! Name a list that will allow a spammer to buy out -- and if you can prove it, most admins will drop it instantly.

And as for proof, I think you'll find that the case files at SPEWS are usually quite detailed.

And it's UCE spam even if they don't hide or blast.

A simple law?

[theMightyE]

Would'nt it be possible to have a simple law requiring all spam (er... valuable retail offers) to contain a standard tagline in their header, something neutral but obvious like 'COMMERCIAL EMAIL'? You'd have to be specific in the legislation so that only one character string was acceptable to avoid having spammers insert non-printing characters, etc., but it could be done. After that, it would take about 2 seconds to add an option that will let people delete these messages as soon as they reach your server.

No free speech problem, since the spammers are still free to send their messages. I'd just be choosing not to view them. People who actually wanted to see spam for some reason could opt in at their ISP. I'd be willing to guess that it wouldn't even hurt the spam business too much because spam-haters like me never buy anything advertised via email on principle.

The one thing I don't know is how to allow real (meaning actually opted-in) email through when I've really requested information on a product. So here's a challenge to all you slashdotters - how can you phrase a law to only allow truly requested messages through without opening a loophole for the MonsterHuts?

The Mighty E