Slashdot Mirror

← Back to Stories (view on slashdot.org)

First CAN-SPAM Lawsuit Filed in California

Posted by timothy on from the this-old-big-house dept.

rocketjam writes "Foster City, California-based ISP Hypertouch, Inc. has filed the first lawsuit alleging violations of the new Federal CAN-SPAM Act of 2003. The lawsuit was filed against BobVila.com and the spammer they hired, Bluestream Media, for sending Hypertouch customers unwanted, unsolicited email advertisements for Vila's "Home Again Newsletter." The suit alleges the defendents sent spam email ads with fraudulent headers and no physical address. It also alleges the emails were sent to randomly generated and harvested addresses as well as addresses that had replied to opt-out links in other spams. Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers." Reader Clemence links to Wired's coverage of the suit.

57 of 167 comments (clear)

  1. Fraud by ScooterBill · · Score: 5, Insightful

    IANAL so I'll ask this question.

    Faking an email header, return address, etc. is supposedly illegal under CAN-SPAM. If this is fraud, then wasn't this illegal before CAN-SPAM?

    M

    1. Re:Fraud by Tango42 · · Score: 4, Insightful

      To you and me (and the rest of /.), that might make sense, because we are used to thinking of the internet as just another part of life. For some (most) people, that isn't yet the case. They seem to think that something happening online is inherently different from the same thing happening IRL. That will probably change over the next decade, but until then laws will have to be tested twice, once for real life, and then again for the net.

    2. Re:Fraud by IANAAC · · Score: 5, Insightful
      No it wasn't. To wit, if I ask a girl for her phone number, and she gives me a fake one, is that fraud under some law? No. However, pretend next year a law is passed that says girls giving out fake phone numbers at bars is now illegal because it is fraudulant. The point is, everything dishonest isn't fraud.

      If you're trying to sell me something with false information, it's fraud. If all your doing is trying to get someone drunk and naked, well...

      Your example is just garden-variety dishonesty (unless, of course, one of you expects a bill or two left on the nightstand).

    3. Re:Fraud by pyrrhonist · · Score: 2, Funny
      However, pretend next year a law is passed that says girls giving out fake phone numbers at bars is now illegal because it is fraudulant.

      I, for one, will work towards making that a reality. ;)

      --
      Show me on the doll where his noodly appendage touched you.
    4. Re:Fraud by Xiamin · · Score: 2, Interesting
      To you and me (and the rest of /.), that might make sense, because we are used to thinking of the internet as just another part of life. For some (most) people, that isn't yet the case. They seem to think that something happening online is inherently different from the same thing happening IRL. That will probably change over the next decade, but until then laws will have to be tested twice, once for real life, and then again for the net.

      Kind of like sales tax?
  2. Hmm by Anonymous Coward · · Score: 5, Insightful

    At first I was kind of worried that the first target gone after was someone "respectable"-- bob vila-- and not like the people selling penis pumps or something.

    But then I thought about it. How much of the problem is caused by ignorant businesses who just happen to hire the wrong marketing firm, and just say "we want you to increase our exposure on the internet" and don't realize this means millions of spam mails sent illegally through hijacked SMTP?

    Perhaps to some degree education is the answer. If other legitimate businesses see bob vila getting smacked for spam mail, maybe they'll panic and make absolutely certain the people they're hiring aren't sending fraudulently-sent spam.

    1. Re:Hmm by Joe+Wagner · · Score: 5, Informative
      Well, we were in contact with them for a bit before we filled the suit. Even after we told them a number of their spam were sent to addresses that were submitted to the opt-out links of other spam, they still refused to promise to never use BlueStream Media again. Shortly before we filed the suit, one of our users recieved another BobVila UCE, this time from a spammer in Florida.

      One of the most compelling aspects in deciding to file this case was that among the various emails messages in their spam run they managed violate nearly every ISP-actionable part of CAN-SPAM. Specifically various email of the spam run had one or more of the following violations:

      1) No street address
      2) False headers, including

      a) SMTP HELO's with names whose IP addresses don't match the originating IP

      b) Domain names used in the headers that were registered with false names...

      3) Addresses that had been submitted to the opt-out mechanisms of other spam
      4) Random and harvested addresses, include domain registration contact addresses.

    2. Re:Hmm by Masem · · Score: 3, Interesting
      I've gotten spam from the BlueStream Media group, that appears more legit than other spam (that is, they don't hide the fact they're advertizing something and yet the ad is readible, not mangled text, and so forth; eg it's nearly good enough to get past a number of spam filters because it looks like a legitamite written email), and representing other clients outside of BobVila. I personally think that's the way the fight has to go, is to make sure that the company that is being advertized in the spam, and not just the spam provider, is targetted in the suits, as once these companies realize that even if they don't send spam directly, usign spam to advertize is a bad idea.

      Unfortunately, more than half of the spam I'm getting lately is now from the fake viagra ones, that, while using viagra, have nothing to do with pfiser, and the actual company isn't mentioned at all, so all you can do is go after the spammer, and not their source of funding.

      --
      "Pinky, you've left the lens cap of your mind on again." - P&TB
      "I can see my house from here!" - ST:
    3. Re:Hmm by Smidge204 · · Score: 2, Insightful

      A valid point. Unless they can proove that BobVila.com knew or explicitly ordered advertising in this form, then shouldn't the company that actually DID the spamming take most of the heat?

      Although, in the long run, this might work out if BobVila.com loses. If hiring non-compliant spammers for advertizing becomes a liability, maybe they'll go out of business!
      =Smidge=

    4. Re:Hmm by pongo000 · · Score: 5, Funny

      SMTP HELO's with names whose IP addresses don't match the originating IP

      And all this time I thought HELO DUDE was a perfectly legit way of identifying oneself to an SMTP server...

    5. Re:Hmm by rixstep · · Score: 3, Insightful

      I don't know good ol' Bob Vila. For all I know, he's just another Nathan Arizona. But it's his business; he's ultimately responsible, as are Blue Stream. I say 'good' if it helps reduce spam.

      Bob Vila might not have known, true, but that's highly unlikely. Blue Stream are in it up to their skinny necks. In either case, they're all responsible under the law, and be glad for that. Otherwise the classic defence will be 'we didn't know, and the employee who did that terrible thing for us is long gone, and we don't have a forwarding address'.

    6. Re:Hmm by ticklemeozmo · · Score: 5, Insightful

      a) SMTP HELO's with names whose IP addresses don't match the originating IP

      That's interesting.. when you send a mail from a windows machine, it uses its NetBIOS name as it's HELO.

      Surely, that's name doesn't match the original IP address when you try to resolve it from the recipients computer.

      Is it me, or is this one of those overly broad clauses they only apply when they need to?

      --
      When modding "Informative", please make sure it both has a source and IS actually informative.
    7. Re:Hmm by toast0 · · Score: 5, Funny

      I personally prefer HELO there. You never know, you could be talking to a non-dude SMTP server... wouldn't want to get them mad at you when you haven't even sent any data yet. :)

      --
      Need a Catering Connection
    8. Re:Hmm by iminplaya · · Score: 3, Funny

      If they ever find him guilty of anything, they can make him do community service, like, for instance, he can build "This old Half-way House" for Martha Stewart.

      --
      What?
    9. Re:Hmm by jadavis · · Score: 2, Interesting

      An employee is different than a subcontractor. A subcontractor should take the responsibility, and the "we didn't know" is a valid defense. You can enforce company policies among your eployees, but not subcontractors.

      It defeats the whole purpose of a subcontractor if you have to micromanage them.

      Now, if you are micromanaging a subcontractor and you encourage them to do something illegal, it may be a different story.

      Also, it seems sufficient to deter us-based spamming if the person doing the spamming is held responsible for illegal spamming practices.

      --
      Social scientists are inspired by theories; scientists are humbled by facts.
    10. Re:Hmm by tftp · · Score: 2, Informative

      No, in civil lawsuits you go after everybody who has any relation to your problem. Unrelated people will be dropped from the suit by the judge. The reason for that is simple: it's very easy to remove someone from the lawsuit, but next to impossible to add one. So you begin with the widest audience.

  3. Show how useless it is by Lord_Dweomer · · Score: 5, Insightful
    "Hypertouch's attorney, John L. Fallat, said the CAN-SPAM Act offers little protection to the public, but they would use the few protections it offers to punish spammers."

    If this case gets a lot of press coverage, it might help show people how utterly useless the CAN-SPAM act really is.

    If a lawyer says its near useless, you know it must be bad. Hopefully the NY Times covers this in depth.

    At least for once they are suing the company who uses the spammer and not just the spammer.

    --
    Buy Steampunk Clothing Online!
    1. Re:Show how useless it is by gravyfaucet · · Score: 5, Funny

      useless. couldnt they have picked a more suitable target? Its not like Bob Villa employs cloned machines and offers to sell you a "legal" building permit, or promises "add three to five stories to your house - naturally and without a contractor". sheesh

      --
      Yes! Evil rules! Good can suck it! Suck it, good!
    2. Re:Show how useless it is by rixstep · · Score: 2, Insightful

      Good point, but it's 'spam' with a 'p', not a 'c'. Scamming is bad enough; this law - and the general objection - is about spam.

  4. Say it ain't so! by Anonymous Coward · · Score: 3, Funny

    Bob Vila sending spam?!?! Next you'll be telling me Norm Abrams wants me to have a longer penis.

  5. This Old Dot-Com by AndroidCat · · Score: 3, Informative

    General article on Bob Vila's ebiz

    --
    One line blog. I hear that they're called Twitters now.
  6. California's tougher law still has some effect by anonymous+cowfart · · Score: 5, Informative
    California's tough spam law is mostly preempted by the new Federal law. But not entirely. The preemption clause reads
    This Act supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto.

    So for any spam that has a forged header or a misleading subject, California's new law, with the $1000 per spam penalty, will still apply. California allows private suits in small claims court by any party. So you can haul the bozos into court. Maybe even across state lines.

    A year or two from now, we'll be rid of the chickenboners, but we'll be getting even more spam from "legitimate businesses".

    --

    So I'm a pervert. Welcome to the Internet.
    1. Re:California's tougher law still has some effect by triclipse · · Score: 4, Informative
      You can also get attorney's fees under the California law:

      "(a)(1) In addition to any other remedies provided by this article or by any other provisions of law, a recipient of an unsolicited commercial e-mail advertisement transmitted in violation of this article, an electronic mail service provider, or the Attorney General may bring an action against an entity that violates any provision of this article to recover either or both of the following:
      (A) Actual damages.
      (B) Liquidated damages of one thousand dollars ($1,000) for each unsolicited commercial e-mail advertisement transmitted in violation of Section 17529.2, up to one million dollars ($1,000,000) per incident.
      (2) The recipient, an electronic mail service provider, or the Attorney General, if the prevailing plaintiff, may also recover reasonable attorney's fees and costs.

      California Business & Professions Code sec 17529.8

      --
      No Inflation Taxation without Representation
  7. Re:fraudulent headers? by Anonymous Coward · · Score: 4, Insightful

    "Fraudulent" refers not to the compliance of the headers with the e-mail protocol, but means that the headers contained information which was false.

  8. Opportunism by StuWho · · Score: 5, Interesting
    "Even if Hypertouch succeeds in its case, the message to spammers and the companies that hire them might not be loud enough to make a difference. The ISP is asking for $100 in damages -- the maximum allowed by the Can-Spam Act -- for each of the approximately 100 messages that it claims were sent by BlueStream Media."

    Sounds like there could be money in setting up as an ISP, and sueing any spammers who use you for $100 per message. Given the millions of messages an individual spammer can send, even one victory against them would result in a cash windfall for the ISP concerned.

    --
    "If you think nobody cares if you're alive, try missing a couple of car payments." Earl Wilson
  9. Who pays for the spam? by d474 · · Score: 3, Insightful

    Until they start punishing the companies that benefit from the ads this is never going to stop. It should be handled like the drug war. If your company is benefitting from ads spammed to millions of people, you go down unless you reveal who you hired to do it.

    --
    Authority questions you. Return the favor.
    1. Re:Who pays for the spam? by crackshoe · · Score: 5, Insightful

      Wait... something should be handled like the drug war? that highly succesful siphoning off of american tax dollars that accomplishes next to nothing? If it was handled as such, i wouldn't be suprised if spammers starting simply directing minors to do the actual spamming, much like the crack dealers that recruited under-age dealers because they wouldn't get the same jailtime.

      --
      Don't worry - its just stigmata. Pass me a napkin and don't you dare tell my mother.
    2. Re:Who pays for the spam? by d474 · · Score: 2, Interesting

      What I mean by "being handled like the drug war" is when a small dealer/user get's busted, either they reveal their source, or do the time.

      --
      Authority questions you. Return the favor.
  10. Spammers "can" spam by ElliotLee · · Score: 2, Interesting

    It's going to be very difficult to prove this. I could send spam and make it look like Slashdot sent it, routing it through some foreign country.

    1. Re:Spammers "can" spam by d474 · · Score: 2

      Yes, but in your example, Slashdot would be cleared once they reveal who they hired, the investigation goes from there.

      --
      Authority questions you. Return the favor.
  11. CAN-SPAM, Politrix, and the unsuspecting victims by segment · · Score: 2, Insightful

    Firstly CAN-SPAM is nothing more than a political tool used by a tool this election year nothing more. For the US to claim to have made a law in places where laws mean nothing - e.g. about those pesky APNIC/LACNIC domains. Now, considering a huge portion of spam gets sent by users whose machines are infected with annoying ass viruses, what is the government going to do aside from possibly bringing in innocent victims - users whose machines were infected or rooted - to court and make them stand trial for something they didn't even know they did.

    Secondly, with every Joe Blow dot com stepping on the scene, how many companies with misconfigured mail servers fall victim to going to court?

    --
    MoFscker
  12. Question by Killjoy_NL · · Score: 2, Interesting

    Ok, what if I send some US-based companies/people spam. Since I'm from the Netherlands they can't really do anything about it, right??

    --
    This is the sig that says NI (again)
  13. great publicity by KingJoshi · · Score: 2, Interesting

    regardless of if they win or how much (little) money they get in return, this is great publicity and it also keeps in the public limelight somewhat the issue of spam and needing better legislation. I'd assume other ISPs would sue, but I wonder which ones are making money off of the spammers...

    --
    In times like these, it is helpful to remember that there have always been times like these. - Paul Harvey
  14. Real Time Filters by d474 · · Score: 3, Interesting

    Couldn't huge email centers (yahoo, msn, etc.) in real time compare source IP's from all emails moving into their systems, identify SPAM as massive amounts of identical email coming from identical IP addresses, load that data into a filter and then block? Some would always get through, say 100,000 but the rest of the 1.4 million get blocked? Isn't anything like this possible?

    --
    Authority questions you. Return the favor.
  15. Hah! by niko9 · · Score: 4, Funny

    I can see the Warden welcoming Bob Villa to the big house: "Welcome to this old Penitentiary"

  16. The idea here by Anonymous Coward · · Score: 2, Interesting

    Remember: If the U.S. can get to the point that all spam is coming into the U.S. from the outside, that is a major win.

    The idea here is to increase the accuracy of filter-based spam fighting techniques. If we can assume-- because the CAN-SPAM act requires it-- that e-mails sent within the U.S. have accurate header information, we can set up much stronger e-mail filters based on that assumption.

    We can't assume email from the netherlands has this assumption, but this just means that these filters are going to increase in higher false positive rates on the spam filters.

    The hope and assumption is that NLian businesses will start complaining to the netherlandese government that they want something like the CAN-SPAM act too, so that email from the Netherlands to the U.S. can be "trusted" and thus less likely to be labelled spam.

  17. you can be sure... by Roger+Keith+Barrett · · Score: 5, Funny

    ...than Bob Vila isn't personally involved. Ever watch "This Old House"? The guy never does ANY projects himself. He always passes it off to that other guy! "Hi, I am Bob Vila for Sears Bulk Mail Services. For just $19.95...."

    --

    Why don't you embrace your slashbotness instead of living in a dreamworld?
  18. I wonder whose cell would be nicer... by Toxygen · · Score: 5, Funny

    ...Bob Vila's or Martha Stewart?

    1. Re:I wonder whose cell would be nicer... by shadowbearer · · Score: 3, Funny

      Well, one would have nice toilet doilies, and the other would have a working toilet. Which one would *you* rather be in? :)

      sorry, I hadda do it

      SB

      --
      It's old. The more humans I meet, the more I like my cats. At least they are honest.
  19. Re:CAN-SPAM, Politrix, and the unsuspecting victim by segment · · Score: 2, Insightful

    and subpeona the names of the actual spammers, then charge them with hacking the computers used to send the spam Did you miss something I posted? Again if someone has their machine broken into, how the hell are they supposed to find out who it was that broke into it if they didn't know how to protect it from the jump? As for your subpoena point, makes little sense, again what are you going to do if Shaka Zulu from Niger broke into your machine, go searching for him? Sure waste 2million tax dollars as opposed to just chalking up what a $ .0002 spam sent. Instead of attacking the endusers, they should be going after the companies who are selling the products being offered. That would definitely stop it, going after an end user does nothing, besides the gov is liable to falsely prosecute some innocent joe shmoe. If you think it won't happen look at what the RIAA did to 80 year olds who never even heard of an MP3. Same players different issue

    --
    MoFscker
  20. FYI: lawsuit homepage... by Joe+Wagner · · Score: 5, Informative
    Hi All, Just FYI, We will be posting updates to the case as they happen at http://legal.hypertouch.com. We think the CAN-SPAM Act is an open license to spam with very little protection for the public, but we are attempting to use what few protections are available to punish some unrepentant spammers.

    One of the biggest problems with CAN-SPAM Act that we are hoping to educate the press so they can inform the public is that the Act says end users _must_ contact each spammer and opt-out. This is of course exactly the opposite of what ISPs have been tell their customers to do. "Opting out" merely gives the spammer have a live address. Some of the email addresses defendants sent spam to were unique addresses submitted to a "virus software 90 % off" spam. In no uncertain terms, "opting out" of spam signs you up for more spam.

    We were surprised when even after we told BobVila.com about the quality of the lists their hired spammer was using, they still refused even just to promise they'd never use BlueStream Media again... Right before we filed the action, one of our users received a new BobVila spam, this time sent through a Florida based spammer.

  21. Bob Vila is more or less fictional... by LostCluster · · Score: 4, Informative

    Yeah, he does exist and that is his real name. However, his association with home improvement is purely a creation of television.

    He was a nobody until a PBS series called This Old House came along in 1979. He was hired as the host of that show. His job duties there were to read the opening and closing sequence lines, and to interview the experts who really did know what they were doing. He was not one of those experts, he was just asked questions to the experts.

    In 1989, when he left This Old House, he created his own TV production company, and used his association with home improvement to get endorcement deals. His primary sponsor is Sears, and his Home Again series can more or less be seen as a Sears infomerical at times. (Sears has always been a title sponsor, and controls a large chunk of the ad space within the program. The content portion of the show might not hit you over the head as an ad, but notice the clear bias when it comes time to select which company's products to work with.)

    His primary line of work these days isn't as a home improvement expert, it's in being the pitch man for Craftsman tools and other Sears brands. He'll endorse other products too, but that's really the only skill people pay him for. You never see him doing any of the work on his TV shows, and that's for good reason...

    1. Re:Bob Vila is more or less fictional... by AndroidCat · · Score: 2, Insightful
      His primary sponsor is Sears

      From a Dec 2001 article:

      Bobvila.com was initially a joint venture with Sears, which held a majority interest. But that relationship ended earlier this year when Sears, no longer enamored of the Internet, unceremoniously pulled out.
      Perhaps that's when the slide to the spammy side started?
      --
      One line blog. I hear that they're called Twitters now.
  22. Yes.... by www.sorehands.com · · Score: 3, Informative

    In many states, there were laws that made using false headers a violation of that state's laws. In addition many states have advertising laws which require the advertiser to be identified.

    --
    Fight Spammers!
  23. What else is new? by Guppy06 · · Score: 2, Offtopic

    Fraud isn't something new to Bob Vila. He pretends to be a carpenter all the time.

    Seriously, ever notice that he does nothing but talk to the people doing the work, and the few times he actually picks up a tool he even makes me seem coordinated?

    A while ago some friends and I caught an old episode of This Old House when Vila was still on it, and in this particular episode he was talking to Norm Abram as he was putting on some wooden shingles. Bob decided to show show his ineptness by putting up a few himself. Comparing the two would have been sad if it hadn't been so damned funny...

    1. Re:What else is new? by LostCluster · · Score: 2, Informative

      This is in part why the This Old House Classics that run on commerical channels are only from the post-1989 seasons after Vila left the show, the first 10 seasons are something WGBH would rather forget.

      Vila was not hired because he knew about construction. He was hired because he looked credible, and could speak well to the camera. He was the host of the show, and that's it.

  24. Will it help any? by Bagheera · · Score: 4, Interesting

    It's nice to see someone at least trying to get something from this Law, since it did such a good job of crippling the stricter state level laws. While I agree that a single national level law is a good idea, they took it in the shorts with this one. CAN-SPAM was a waste of paper.

    The sad thing is during a recent review of my spam trap account (11800+ email in 3 months) a grand total of 30 of them were from "legitimate" business. The rest were for your usual run of penis pills, bad mortgages, "Stop spam now" software, and herbal vi@gra.

    Now, if I could collect on each and every one of them, I'd be a wealthy man. But the vast majority are coming in through open proxies or trojaned Windows boxen, and are annoyingly difficult to track back to their source - which is often off-shore and out of reach of the CAN-SPAM act in any case.

    Going after a legitimate" company like this is may put a slight damper on SPAM sent by "real" companies, but it does little or nothing to stem the flood tide of crap we get from the low lifes who are at the root of the problem.

    --
    Never attribute to malice what can as easily be the result of incompetence...
  25. Windows: the (un)suspecting victim by mousse-man · · Score: 3, Funny

    I think running Windows is already legally aiding and abetting spamming. I wonder whether this is punishable...

  26. Re:foster city by Joe+Wagner · · Score: 4, Informative

    It appears that one of BlueStream Media's customers is also in Foster City, DrySkinOnly.com... Small world. The local DA is taking complaints about spam, though you have to get through a disinterested police force. If you have any pre-2004 spam that has no ADV label, that is punishable under the old CA law by up to one year in jail. If you have the time and energy, file a complaint and follow up on it...

  27. Just imagine for a sec by st0rmshad0w · · Score: 2, Funny

    Imagine the sweet livin on the cell block with Bob and Martha!

    Wow. The mind boggles.

    Prolly never would have happened if Norm were still on board.

  28. ignorant businesses by DavidDeLux · · Score: 3, Interesting

    Only yesterday I got some UCE from a local company... a nice large PDF file containing details of a promo they were doing for photocopiers. This company clearly think its OK to send out such junk... whilst they included in the message their email address to request to get off their list, the replyto address was a placebo... so for that alone they're breaking the acceptable use policy of the ISP that they sent from... who got a suitable complaint from me (and I hope they yank their account!). Now, this company were using some software to bulk send these messages (pdfmail)... and they harvested my email address from somewhere. You would have thought that by now comapnies would know better than to send out SPAM/UCE.. in my case the company sent crap themselves, so they can't even blame some unscrupulous marketing company.

  29. My seemingly obvious method of getting rid of spam by Killswitch1968 · · Score: 2, Insightful

    What I never understood is instead of going after the spammers, can't we go after the companies hiring the spammers? They would be far easier to track down. They must have websites to solicite their garbage, with credit card payments and lots of contact info.
    I can see the potential for people to 'fake-spam' and get a company into trouble, but is this the only problem?

    --

    Corporations: your universal scapegoat for all society's ills.
  30. Re:fraudulent headers? by HrothgarReborn · · Score: 2, Interesting

    I hate spam as much as anyone but this is true. We are talking about somebody put some 1's and 0's where they shouldn't. Is this really a crime? I'm not even sure its a violation of an RFC.

    No attempt was made to destroy or steal anything. Even the theft of bandwidth is comical. Compared to how most /.ers feel about how copyright violation doesn't really hurt the artist very much, aren't we being just a bit hypocritcal when we say we should sue people who just bug us?

    Let's jump off this litigation wagon for such trivial problems and start working on a way to make something like digital signatures work.

    One caviat. People who send obscene unrequested emails are in a different catagory. With them you can actually show they are violating peoples rights as much as any flasher in the park.

  31. HELO behavior and greylisting by Frater+219 · · Score: 3, Interesting
    a) SMTP HELO's with names whose IP addresses don't match the originating IP
    That's interesting.. when you send a mail from a windows machine, it uses its NetBIOS name as it's HELO.
    ... Well, my mail server does not need to be receiving mail from remote Windows client systems. Windows mail servers, yes, but presumably those can follow the protocol and HELO with their real name, not their Microsoft made-up toy name.

    Indeed, I might be willing to discriminatorily greylist all mail from any remote Windows system. (Greylisting: Sending a 4xx temporary failure the first time a host tries to send mail to a particular recipient. This causes a normal MTA to retry in a few minutes, but fire-and-forget spamware and worms generally abort.)

    How to apply this to Windows only? OpenBSD's passive OS fingerprinting would be a start. It allows one to selectively redirect traffic based on the detected OS, and thus to offer different quality of service based on the quality of the client system. Since there is a much greater likelihood that a given Windows host's connection to my MTA is delivering spam and worms than that a given Solaris or Red Hat host is delivering spam and worms, there is a good reason to deteriorate service (as by greylisting) for Windows hosts -- as long as it can be done in a way which retains (eventual) delivery of real mail.

    If Unix mail server admins all chose to greylist remote Windows hosts -- including Windows MTAs as well as client hosts -- then Windows servers would eat the cost of keeping messages in queue during the greylisting period. This would, effectively, be the cost of proving you're a real Windows MTA, not a worm or spamware. This lays part of the burden of the Windows system's susceptibility to malware back upon those responsible for it (deployers of Windows) whereas currently they are able to offload it upon the rest of us in the form of junk mail from worms.

    (Incidentally, yes, the majority of mail exchangers run some form of Unix. Less than half, however, run Sendmail.)

  32. Tracking Spammers by Detritus · · Score: 2, Interesting

    One way to find out the identity of the spammers is to follow the money. Someone with the power to issue subpoenas should be able to find out where the money is going. An old trick is to write a check to the person under investigation and see where it goes.

    --
    Mea navis aericumbens anguillis abundat
  33. BobVila.com has posted a reply... by Joe+Wagner · · Score: 2, Informative
    BobVila.com's reply can be found here and says:
    The following statement is released by Jack Hill, chief executive officer of BVWebTies LLC, owner of BobVila.com, in response to media inquiries involving the anti-spam lawsuit against BVWebTies LLC filed by Hypertouch Inc.:

    BOSTON (March 5, 2004) - "BVWebTies LLC, owner of BobVila.com, takes the issue of junk e-mail seriously and believes it has operated in full compliance with the CAN-SPAM Act of 2003. We remain committed to respecting and serving our customers. We were shocked by this action, and believe that BVWebTies will show that it operated in good faith and in full compliance with existing law."

  34. HELO HOMECOMPUTER by csk_1975 · · Score: 2, Interesting

    After noticing all the spam sent from machines using uppercase non qualified HELO names I hacked our SMTP listener to trap all the mail sent from them.

    I did this in November and so far its trapped tens of thousands of spam mails and less than ten valid mailers. Of these valid mailers, two said they had no idea they were using these names and promptly changed them to FQDNs, one was not happy, and the others didn't respond to my messages so their mail is still trapped/refused - my users didn't want the mail from them anyway so its really no loss.

    I'd recommend blocking HELO NETBIOS-NAME for incoming mail as it stops heaps of spam with very little impact on valid mail.