OptInRealBig Wins Restraining Order On SpamCop

arikb writes "Some online newspapers are reporting that the infamous Scott Richter and his company OptInRealBig won a temporary restraining order against SpamCop. The TRO prevents SpamCop from sending complaints about OIRB to their provider or removing email addresses from the complaints it receives which regard OIRB. I think we will rue this day for years to come." Update: 05/12 16:43 GMT by T : The Ultimate Fartkno writes "HillsCap, a fed-up SpamCop user, is now organizing a class-action lawsuit to be brought against Richter and Opt-In. At least 1,000 signatures are needed, so tell your friends!"

Comments

The Root of Spam

[ca23e]

These companies will continue to use whatever legal tactics they can so long as the response rate to their spam makes it profitable to run their business.

While I'm all for the further development of spam filters and blocking spammers, our inboxes will not be free of it till people stop BUYING from their advertisements.

Re:The Root of Spam

[smartin]

While I'm all for the further development of spam filters and blocking spammers, our inboxes will not be free of it till people stop BUYING from their advertisements.

People say this all the time, but obviously it is an unworkable solution. What really needs to be done is to penalize companies that use the services of spammers. Clearly in order for spam to be effective the company selling the product must be accessible. The law, (and/or those practicing vigilante justice) need to insure that those trying to use spam pay more than they make from it. Once it becomes impractical to use spammers, the spammers will go out of business, fall into deal depression and hopefully take their own lives.

Wrong Approaches

[jenohn]

We are approaching this wrongly in so many ways.

There are legal methods which will fail because there is already precedence with SPAM grocery mailers, etc. There are also smart lawyers working (for high dollars) for the spammers who can get cluelesss judges to support the SPAM purveyors.

There are firewall/spam blocker methods that will continue to fail as spammers learn the tricks to route around them. This is the old hacker/security expert game. Build a better lock/block and it will soon be cracked/by-passed. The cycle is repeated ad nauseum.

The only real method of fixing this is to charge for e-mail. Once the spammers have to pay then their rate of return (ROI) will decrease so that it is no longer a viable business model.

Yes, this means we will pay for e-mail. I hate the idea as much as you, but I cannot see a working solution in any other method.

Re:Wrong Approaches

[Anonymous Coward]

>There are firewall/spam blocker methods that will continue to fail as spammers learn the tricks to route around them

You don't know what you're talking about. Firewalls have nothing to do with spam, and as far as spam filters go I find that a well trained Bayesian filter is good at blocking 99.8% of all the spam I receive.

I use PopFile at home, which is traight-forward Bayesian filtering but we use SpamAssassin at work, and that uses other methods to identify spam, such as IP blacklists and some of the methods spammers use to he/p the1r maIl $lip by the fil.ters. SpamAssassin is regularly updated too, so if ever the spammers find a way to circumvent the filter then the filter is simply updated.

>The only real method of fixing this is to charge for e-mail

STUPID STUPID STUPID.

First of all, what happens if a trojan is planted onto a machine (either by a drive-by browser hijack, or rogue email, or just plain user stupidity) and the user's computer is used to send spam (by the way, that's how a lot of spams are sent nowadays anyway). The user gets stiffed for a huge bill and the spammer gets away scot-free.

Secondly, what about mailing lists set up by newsletter admins, or cron jobs which send email to other sites saying "backup tape needs changing"?

How do you propose to set up an email charging scheme which cannot be evaded by hackers/spammers? And where does all the revenue go?

Re:Wrong Approaches

[Steve B]

How does nonsense like this get modded up as "Insightful"?

There are two possible rules: "You must pay to send e-mail" or "You may not spam". If you can enforce the former, you can enforce the latter. If you cannot enforce the latter, you also cannot enforce the former. Thus, if you're going to make a rule, it ought to be the latter (which impacts only abusers) rather than the former (which impacts everybody).

This really is no big deal

[MrByte420]

These arguments Richter is bringing up have had their showing in courts before. Richter complains that spam cop is interferring with his business. Spam Cop is doing no such thing. Spam Cop is not forced upon anyone. Spam Cop has given out their negative opinion about something and the target is just trying to shut them up.

Suppose I create a website which rates hardware for PCs and I decide that such in such Video Card really fucking blows big chunks. This is akin to the manufacter trying to argue that I am interfering with his business because I'm telling everyone his product sucks - as long as I'm not being intentionaly libelous, I would think I'd be 1st amendment protected.

Remeber that lawsuit last year from that copany that magiccaly sprung in Flordia just to flie a suit and disappear? That blew over - Spamhaus is still around and this will too.

Re:Chicken Little

[merlin_jim]

Just a thought; would this then require OIRB to positively identify which mass e-mail campaigns are theirs, so that SpamCop can comply with the injunction?

I mean in order to comply, OIRB would have to provide identifying characteristics of their e-mails, right? Isn't that just what all the spam filter guys have been looking for? Identifying characteristics... yeah I know, easy to change next week, but in the meantime they'll have a definitive list, giving them a clue into this week's state of the art in spam obfuscation...

One problem is the Can Spam Act

[OhHellWithIt]

I hate to say it, but I actually feel some sympathy for the spammer. I understand the Can Spam Act requires spammers to stop sending if recipients tell them to stop, but how am I to know that a given spammer is under U.S. jurisdiction; therefore, I will not tell the spammer to stop, lest I confirm that my email address is valid.

The problem is that any law that allows people to send spam legitimizes the activity.

Re:As I said before he is still going to win

[That's Unpossible!]

As long as he is fully following the federal can spam act rules he is on strong legal grounds.

To continue spamming, maybe. But how is he on strong legal grounds to force a company to stop classifying his email as "unwanted," when that is exactly what spamcop does. They take complaints, record them, munge them, and pass them on to service providers.

CAN-SPAM says "you can spam, if you do it this way, and you won't be sued or thrown in jail." But it doesn't say other people can't filter you, file complaints against you to your ISP, etc.

This is retarded.

Re:Frivolous lawsuits

[Shimbo]

Or the judge who issued it?

It seems entirely reasonable to me, in the first instance, to rule in favour of the spammer.

Spammer: these guys are interfering with my business.
Spamcop: No, we're not.
Judge: Well, just lay off them a bit, while I think about it.

Re:Chicken Little

[Liselle]

I mean in order to comply, OIRB would have to provide identifying characteristics of their e-mails, right? Isn't that just what all the spam filter guys have been looking for?

You only have to look as far as your inbox. True to its name, if you sign up (heh) for OptInRealBig spam, you can be assured you'll get lots more spam from OIRB's "partners".

I think you answered yourself. Sure, it would help for a week, but then the method would become ineffective, and we'd be stuck with it. Useless, and with more overhead to boot. No, Scott Richter just needs to be shut down, period. You can't kill all of the cockroaches, but you can kill the big ones that can't run fast, and like to give TV interviews.

Throttling

[Sly Mongoose]

The only way to eliminate SPAM is to make it unprofitable. Since the world is full of fools, we can't count on them to just not respond to SPAM so we need to reduce the numbers of SPAM messages sent by the spammers.

We need some sort of real-time, content-driven connection throttling on the mail servers of the world, so as to reduce the number of SPAM that can be sent in any given time. The inbound mail can be analysed on-the-fly and if the word pen1s or vi@gara is detected, throttle the connection so that mail takes 60 seconds to send.

Throttling will only affect mass mailings. Who cares if their legitimate mail about V.I.C.O.D.I.N is delayed by 60 seconds? And there will be no false-positive difficulties because all mail will eventually get delivered. But bulk-mailers will discover that they can send far fewer SPAM in a day, which drops their response rate and their profitability. Hopefully to the point where they can't sustain their business any more.

Re:Chicken Little

[grahamm]

And if they did that, the ISPs (and others wishing to block spam) could use that 'signifying' characteristic to block the spam and would not need to refer to spamcop (or other blocking lists).

Re:So?

[AndroidCat]

Listwashing. Each single complaint represents thousands(?) of people that Just Hit Delete or filtered it to /dev/null. After a while, Snotty's mailing list has a lot of the people who will complain about spam tagged as "do not send" as well as "confirmed good email". Then he'll sell his lists to other spammers with the first tag stripped off...

Anonymous complaints

[nuggz]

One of the most valuable commodity to a spammer is known good email addresses. Why should we give him more.

The ISP should simply ignore the complaints, do a spot audit of his spamming, or just get rid of him because almost nobody wants spam anyway.

This is stupid

[Paulrothrock]

How is this different from OIRB suing me when I delete one of their spams? SpamCop is selling a service that deletes it for me so I don't have to deal with it.

Re:Chicken Little

[johnnyb]

First, I know nothing of OIRB specifically. However, please don't assume that all email marketing companies are spammers. It just isn't true. I work for a company that does email marketing, and our server has had the same IP address for over a year, and all of our emails come from the same domain, with clear opt-out instructions (in addition, you had to have opted in directly to have received it to begin with).

There are some of us companies who actually do send legitimate email where the recipients are trying _to_ receive the message rather than trying to block us. I have personally walked many people through turning down their anti-spam software to make sure our messages get through to their system.

Anyway, I think it would be wise to be sure that we remember that not all commercial marketing email is bad, or else I'll wake up one day and half.com will no longer be sending me email updates about which books I want have come in at the price I specified (which is in fact the most effective form of email marketing).

Re:How's this happening, again?

[Steve B]

They're interfering with businesses, and they're blocking communications.

They are doing no such thing. They are informing the rest of the world "So-and-so is a spammer". The rest of the world rejects messages from so-and-so, or not, as it chooses.

Re:Chicken Little

[pqdave]

"That, in a nutshell, is confirmed opt-in. It is the ONLY legitimate method of bulk E-mail advertising."

BS.

First of all, confirmed opt-in opens itself up to just as much spam as non-confirmed opt-in. You just wind up with a bunch of spam that starts "We have received a submission from someone claiming to be you to join our mailing list, 'Vicodin available at example.com'.

A genuine opt-in message shouldn't have advertising within the confirmation message, it should just say 'At 10:30am from IP signed up for the vicodin user's mailing list. Please click on this link or respond to this message to join the list"

In order to verify your email address for the opt-in list 'Vicodin available at example.com', you have to reply to this message.

Second of all, the only practical problem with unconfirmed opt-in is that it's your word against theirs whether or not you really opted in. Oh wait, that's true anyway. The only thing confirmed opt-in gives you is that people who don't know how confirmed opt-in works wind up not being able to get useful emails, and only get crappy spam rather than the emails they want.

The other thing you get is that if you DO get complaints, you can pull out their confirmation mail, complete with headers to show that they did sign up. You could forge the confirmation messages, but forging their ISP's headers will be more difficult.

We've tried confirmed opt-in and the only results are that we have a bunch of people emailing us why they weren't added to our list.

With regular opt-in, we have gone for over a year without a single complaint. I think the redhat-list has more problems.

"If your company is not doing those exact steps, in that exact sequence, you're spamming. Period."

Yes. Period. Because _you_ say so. Obviously, I should always consult you on definitions of any words I use, because you are the only one with correct answers.

Actually, I probably wouldn't have a problem with you, as long as the lack of complaints is legit. I've heard is that a vanishingly small percentage complain, and fewer still complain to the right place.

Even if you are legit, without confirmation I won't have sympathy if you get in trouble with your ISP for some moron forge-subscribing your mailing list to addresses harvested from news.admin.net-abuse.email

"If you are spamming, please tell me which marketing firm you're with so I can place your IP address range(s) into my domain's 'Deny' list for the mail servers."

If you or your users ever receive email that they didn't want, and the issue is not resolved completely to your satisfaction, I encourage you to do this.

Think of it this way. Let's say someone signs you up for a list that you didn't want them to. In the case of confirmed opt-in, they will get one useless extra email. In the case of unconfirmed opt-in, they will get one potentially useful extra email that they only have to reply or click on to get removed.

Here is a problem--Many of the "reply to remove" or "click to remove" instructions are actually "click to add". I've proved this to my satisfaction experimentally: Got a spam in one account, "replied" to the remove address from a new, otherwise unused and non-guessable account. Result? The new account started getting spam. I can't tell the difference between scammers and mistakes.

Some of the remove links are dead, some want a password, some have other hoops.

In the case of confirmed opt-in you're wasting bandwidth sending junk (and the spammers are going to spam with the "verification" messages anyway), and in unconfirmed you actually get content. Either way is open to abuse by bad parties, but confirmed opt-in causes problems for some of the computer-challenged.

Confirmed opt