Spamhaus Responds To Spammers' Lawsuit

ShaiHulud-23 writes "A suit was recently filed by EMarketersAmerica.org, a fledgling secret organization of spammers, against the Spamhaus Project, (and other anti-spam sites) seeking to prevent the publication of the anonymous plaintiffs' IP addresses in the Spamhaus Block List (SBL). The suit requested a response from the named defendants, and Spamhaus director Steve Linford has provided one, dismantling the spammers' case point by point."

Comments

No ground

[The Bungi]

I think the key point here is that use of an IP blacklist is entirely voluntary. So this sleazeball can hardly claim that Spamhaus is actively trying to "block his business".

Talk about clueless and groundless.

Re:No ground

[secolactico]

Talk about clueless and groundless.

Groundless, yes. Clueless, I don't think so. They are simply playing dumb and hoping to stir the hive to get some honey (wich might very well end in them getting stung).

Some believe that thieves are the best security advisors. This guy probably knows all about spam and anti-spamming methods, and if he doesn't, he probably has a tech person who does.

And if, as a lawyer, he seriously expect this lawsuit to prosper, he is even more incompetent than Lionel Hutz (yes, this is a gratuitous Simpsons reference).

Re:That's nice...

[ShaiHulud-23]

The original lawsuit was newsworthy because it was a cartel of spammers attempting direct legal action against a system which blocks their messages, claiming that Spamhaus restricts their free speech and free trade.

The Spamhaus response is just a followup to the earlier story, and is an interesting insight into the fraudulent dishonest mindset of spammers by pointing out the falsehoods in the suit.

This whole issue is newsworthy because it calls attention to the overall deceptive sleaze of spam in general, it is NOT a legitimate business. While the racketeering story posted earlier isn't quite the right solution, I do think that if the courts are made more aware of the shady (and sometimes outright illegal) business practices of spammers, more anti-spam suits will be won and more anti-spam laws will be passed. Spam is a crime that just hasn't been made illegal yet.

Discovery! Yeah!

[jcr]

Spamhaus should depose the plaintifs, and get the names of EVERY one of the greasy little bottom-feeders that's given them any money for this frivolous litigation.

-jcr

Re:Can anyone answer me this?

[chota]

I think that's exactly the point, and why Spamhaus responded the way they did. No, common sense is the same in the States... at least among non-idiots. ;) Let's just hope they get a good judge that immediately tosses this one out, and, yes, must pay reparations for wasting the court's time. chris.

Re:UK in American courts?

[CausticWindow]

It's not at all obvious.

We are coming to a point in history where US law is converging to global law. Military might talks. Mind you, it doesn't work the other way.

The spam assholes of America are some of the least dangerous assholes though. The US is brim full of more dangerous assholes.

Sue for anything

[nuggz]

You can sue for anything, really you can.

You should be allowed to sue for anything.
Who should judge what is worthy? A judge of course, nobody else should be allowed to make the decision if the case should proceed.

I don't see a better solution.

Re:Spam vs. Commercial Email

[jcr]

If I sign up for Yahoo and check the boxes saying I want to receive email about something, it is not spam, no matter how much I whine about it. If I can respond to the email and request to be taken off a list and actually be taken off of it, then it isn't spam. Not all commercial email is spam.

Let's be very clear on this. Your first statement is correct. Your second statement, however, seems to claim that it's not spam if the remove address works, which is 100% bullshit.

-jcr

Re:here's a mirror

[hillct]

Be a good citizen and remove the popup ad from your mirror of the SpamHaus letter. If you must, slap a banner ad or a few sponsored links on the page, but yank the damn popup as it's diametrically opposed to the spirit of offering a mirror.

Re:Discovery! Yeah!

[billstewart]

Isn't it fun when they go out of their way to toss a nice slow pitch right over the plate? (Hmmm. American Baseball may not be totally familiar to Steve at Spamhaus, since he lives in the UK, but actually that plays into the real point...)

Spamhaus isn't a US entity, and Steve Linford isn't a US resident, and it's highly likely that the court has no jurisdiction over his actions, so it may be much cleaner for him to say "no thanks" and not be part of the suit. That means he may not get to play the Discovery game (or at least he'd need a real lawyer rather than me advising him.) But any of the US-based defendants certainly can go file discovery motions as part of their response, even if the result of them is to demonstrate that they're not part of the suit or that they didn't do the actions they're accused of or that those actions aren't a tort.

You can have *so* much fun with discovery in this - not only should they be able to get the names and real addresses and phone numbers of all the spammers that the plaintiff alleges are part of his organization, but also

• all the IP addresses and domain names the spammers own or use and
• copies of all the ISP contracts the plaintiff alleges to have, or that the plaintiff's spammer buddies allege to have, and
• any other ISP contracts that they have which the plaintiff is *not* alleging were blocked, because that obviously indicates something relevant, and
• exactly what hardware and software and which ISP connections were used to deliver the spam that was allegedly blocked, and what recordkeeping capabilities it has, and
• any records they have about the dates and times and recipients that they attempted to deliver messages to which were blocked, and
• how they determined that the recipients use SBL as instead of or in addition to other blocking lists, and
• why they assert that SBL was actually used to block their spam as opposed to some other list, and
• the contents of those messages, and
• who if anyone had hired them to deliver the messages, and all their names and addresses,
• or if the spammers were trying to sell the products themselves, exactly what those products were (Ajax Model 28 Penis Expander), or if they were medical products, whether they met all legal requirements for selling them, e.g. Viagra,
• or if the spammers were promoting web pages with their spam, exactly which web pages and who paid them to promote them, and
• where they obtained the addresses of the recipients they were spamming, and
• whether the information was delivered directly by the spammers, or by using open relays and/or open proxies, and their IP addresses, and whom they obtained permission from to use each of those, and how they located them, and
• precise cost accounting data used to calculate the alleged damages, especially because the spammer alleges, probably correctly, that they're high enough to trigger some jurisdictional or procedural effects under Florida law,

and any other information you can think of that the spammers would probably rather NOT have exposed to public view. And be sure to get all of them in electronic form, and delivered to all the defendants, because even if Steve Linford and Spamhaus aren't under US or Florida jurisdiction, they're certainly parties to the case, and it'd be a real shame if there were no particular way to impose confidentiality rules on the non-US defendants for use of that data.

Yeah, it seems like a lot of data. But the plaintiff's suit doesn't just claim something fuzzy like libel (where he might have had a chance suing in the UK, though probably less likely here) or restraint of trade, it claims that the defendants engaged in activities that caused damages to the plaintiff by interfering with the plaintiff's legitimate activities, and that means that the actual activities that the plaintiff claims to have engaged in and the defendant's actions which allegedly i

Re:Spam vs. Commercial Email

[An Onerous Coward]

All I want to know is, how the hell am I supposed to tell the difference? I get e-mails from RedHat, because I signed up for their newsletters. I get them from Yahoo, because I signed up for their services.

But how are you, the consumer, supposed to tell if one of your "white hats" is actually one of Yahoo's "marketing partners?" Seriously, every spam I get comes with a disclaimer that says I "opted in." I remember one especially infuriating one that listed about a dozen different ways to opt in, and at least half of them were so vague as to make it impossible to say, "no I didn't."

My philosophy is, if I'm not absolutely sure I signed up for something, then kill them all. Let /dev/null sort them out. If an e-mail "marketer" is using some obscure loophole in some bogus website EULA, then they're not white hats. They're just not the deepest shade of black around.

Not Pro-Spam, but....

[JWSmythe]

I am anything but pro-spam, but I'm happy to see the blackhole lists get kicked around a little bit. Some of my accounts get hit more than the average person, because they are well placed on many web pages, or have been in use for years and are now forwarded to my account when people leave the company. I average about 200 spam messages per day coming into my account.

$RANT_MODE="ON";

I also handle many networks, with many many machines. Some of our networks have other people's equipment on it, but I'm 100% positive that they don't spam from their machines. Since they frequently ask me to help with their configurations, or help with problems, I'm intimately aware of what they do.

If there are spam complaints, they filter through to me very quickly. Level3's abuse account gets most of them. They filter out most of the bogus complaints, and are quick to get with us about legitimate complaints. We did have one machine hosted on one network that was spamming, which we ejected from the network shortly afterwards.

On a monthly basis, someone will come to me saying that they've been blacklisted by one of the many lists for ambiguous reasons. Any incident that is legitimate is cleared up between us and our bandwidth provider, under the threat of having the IP or IP block blocked from all Internet access. Level3 Communications is very anti-spam. They'll cut you off for being a spammer. If we don't explain or handle an incident, we could very easily loose our lines. I have no problem with this.

The last case with Level3 was a single spam complaint, sent through SpamCop. The message wasn't a spam at all. Someone had made a purchase online with an invalid credit card number. The Email simply stated that they had attempted a purchase (with IP and invoice number), and said if they still intended to make the purchase, they should contact the sales department at the store. I know the owner of the store personally, so I called him. He freaked out when I told him there was a spam complaint. This is a business man who is the most honest person I know. (If in Ft. Lauderdale, tell Glenn I say "hi"). I read the Email to him, and he confirmed that it was a legitimate message, and the card had been bad.. He immediately cancelled the order, and blacklisted the customer. The next day I got a forwarded Email which was an apology from the customer. She sends every Email off to SpamCop, and lets them sort them out. Nice, huh?

Now on to the abuses of the spews system. SpamHaus is /.'d right now, or I'd complain about them, but lets check who we can.

65.59.224.0/25 is one of our networks. A small backwater of our network. A few older machines live there, and not much happens. SPEWS has 65.59.224.0/24 blacklisted, as well as 66.166.136.128/24 which is no relationship to us (the wrong network size is theirs, not ours). Because I have machines on the first half of 65.59.224.0/25, I'm blacklisted. 65.59.224.128/25 could be blacklisted, but I happen to know that they have quite a few hosting customers, most of who know nothing about the other customers.. Legitimately blacklisted??

ORDB has my ex-girlfriend's mail server listed. She develops and hosts sites. No spamming at all.

65.59.224.11 is listed as herbalo.com. Funny thing is, it doesn't exist on our network.. I'll personally escort anyone from spews into the colo to prove it to them.. Oh wait, I forgot, these are anonymous people who don't exist in the real world and don't feel themselves accountable for blacklisting innocent networks.

AOL has blocked one of my own servers, as well as those of two different friends (on their own networks) for "potential spam".. One of them had a *WEB* proxy server, and aparently because it existed (on port 8000), he was blacklisted from sending

No. Re:IANAL...

[DDX_2002]

Pleadings aren't made under oath, so nothing contained in them can be perjury. If you deliberately state facts you know to be false, however, you could run into civil liability for abuse of process.