Spamhaus Fine Reduced From $11.7M To $27K

eldavojohn writes "In 2006, anti-spam crusader Spamhaus was sued for 'defamation, tortious interference with prospective economic advantage and interference with existing contracts' after blocking 'promotional e-mails' from e360. What with the case being in Illinois and Spamhaus being a British outfit, Spamhaus didn't bloody care. So, e360 was awarded $11.7 million in damages, which was later thrown out in an appeals court with a request for the lower court to come up with actual damage estimates instead of the ridiculous $11.7 million. (e360 had originally stated $135M, then $122M, and then $30M as sums of damages.) As a result, the actual damages were estimated to be just $27,002. While this is a massive reduction in the fine and a little bit more realistic, I think it is important to note that Spamhaus is a service that people proactively utilize. They don't force you to use their anti-spam identification system — it's totally opt-in. And now they're being fined what a foreign judge found to be 'one month of additional work on behalf of the customers' to a company they allegedly incorrectly identified as spam. Sad and scary precedent."

Comments

Re:On the fence

[eldavojohn]

So I mean, yeah, its scary that they lost a case where essentially they incorrectly identified spam (an easy mistake) ...

Who decided that they were incorrectly identified as spam? From the article:

e360 claimed that about 3 billion of the more than 6.6 billion emails it sent on behalf of clients

Please do tell me what kind of business (one that I've never heard of, mind you) sends out e-mails totaling the world's population and in what manner is that legitimate?

Curiously, nowhere does e360 have to defend this action. So, yeah, you can be on the fence if you think that any spammer should be able to sue Spamhaus (a free service) in any country on the globe and expect Spamhaus to front money for representation and whatnot in all those countries. Sounds like a pretty good strategy for spammers to take out Spamhaus since it's probably a growing thorn in their side.

As the submitter, that's where I stand on this issue.

Re:What's more outrageous...

[Anonymous Coward]

He didn't have any alternative; SpamHaus didn't show. The judge isn't allowed to take sides or consider evidence that wasn't presented.

If this wasn't the case, you would never be able to successfully sue for redress; the other side could simply fail to show up.

No the problem was they initially turned up and then walked out. No precedent, no story. Spamhaus/their lawyers f**ked up, the result was they had to pay a spammer for the f**kup. If they hadn't showed in the first place there would have been no judgement and no jurisdiction.

Re:It's their own damn fault

[Anonymous Coward]

Once you start showing up to court, you have to continue showing up... except in the very rare case where you're provisionally appearing strictly for the purpose of debating proper jurisdiction.

I thought that's exactly what Spamhaus did.

Re:My Support

[Nematode]

The amount of taxpayer money involved in having a court enter a default judgment is effectively zero.

There's a little bit of time for the court clerk to enter the case on the docket, then the default judgment is signed. Not much more to it than that.

you'd have a point, except that you don't

[Anonymous Coward]

You'd have a point, except that in this case you don't.

Spamhaus did initially show up, which was an acknowledgement that the US court has jurisdiction. Had Spamhaus either entirely ignored the suit or stayed to convince the judge that they were a wholly foreign corporation with no US presence, that'd be fine. But they half-assed it, and so the judge had to provide a ruling; absent any representation for Spamhaus, a default damage award was entered.

Re:My Support

[Nematode]

I'm not underestimating it. If no answer is filed to a complaint, a default judgment takes about as few of the court resources as is possible. The clerk receives a complaint. The clerk enters a little data into the system, stamps the summons, and puts it back in the mail to the plaintiff. When the proof of service is received, that's put in the file. When the default judgment request comes in, the clerk stamps that, updates the system to reflect entry of the judgment, and then it's done.

In the unlikely event that the cumulative civil servant time involved in this case reached "a few tens of thousands of dollars" (and having read the procedural history, I'd guess it was more like a few hundred dollars), that would be....Spamhaus' doing, for having the case moved from the state court to the federal court, then showing up at a hearing to withdraw its answer.

I'm not at all sympathetic to the spammer here, but...this whole thing is a little ado about nothing. Random spammer gets an unenforceable default judgment. The amount of skin off of the backs of anyone reading this article is so negligible as to be effectively zero.

Re:tortuous...

[Koutarou]

Spamhaus doesn't do a whole ISP-level block unless something pretty egregious is happening.

The usual process goes:
1. Complaint to ISP, no response
2. /32 block, more spam, complaint to ISP, no response
3. escalation to block somewhere between /25 and /29 depending on identification of block size, more spam, complaint to ISP, no response
4. escalation to /24, more spam, complaint to ISP, no response
5. escalation to ISP's corporate mail servers - usually something happens at this point when suits notice their own mail getting blocked
6. escalation to ISPs entire allocation

Re:Spamhaus was right to ignore it...

[Cheerio Boy]

You can argue about them not showing up in court all you want but they did not show up in court because they knew the Illinois court had NO jurisdiction on their actions. Read their take on it here:

http://www.spamhaus.org/organization/statement.lasso?ref=3

Then read a breakdown from 2006 by Groklaw here:

http://www.groklaw.net/articlebasic.php?story=2006102700261694

Spamhaus is a FOREIGN company doing business on FOREIGN land. They have no need to show up for a court appearance in what amounts to a provincial court in another country.

If e360 had been based in Upper Monrovia or some similarly remote place other than the US this would have never have flown. And even if it had flown due to judge-shopping they would still be right to ignore it due to jurisdiction. The only reason this has gotten this far is that the US court system is broken and arrogant enough to think it applies to the entire world.

Got a problem with a foreign company doing business on their own soil? Take it up with your government. _Your_ courts have no jurisdiction to prosecute.

Though I agree that they've done nothing wrong:

[phyrexianshaw.ca]

Keep in mind that Spamhaus DOES operate around the globe.
from their site:

"To meet public demand for its DNSBLs, Spamhaus has built one of the largest DNS infrastructures in the world. Its network of over 60 public DNSBL servers spread across 18 countries serves many billions of DNSBL queries to the public every day, free of charge."

for a business to operate equipment in a country, that equipment is required to follow laws pertaining to that country.

Re:What's more outrageous...

[corbettw]

From what I remember, that's not what happened. They testified that Spamhaus was conducting business in Illinois. Which they were, since they were providing their service to people and businesses in Illinois. The judge did the right thing by applying the law and not what Skuld-Chan thinks is "common sense".

Where the action is aimed.

[www.sorehands.com]

Part of the theory is that you direct harm to a jurisdiction, you are subject to that jurisdiction. See Calder v. Jones, 465 U.S. 783 (1984). http://en.wikipedia.org/wiki/Calder_v._Jones

Now if you are in Spam, hijack a system in Korea to send spam to China, where should you be liable?

Re:Where the action is aimed.

[Firethorn]

Now if you are in Spam, hijack a system in Korea to send spam to China, where should you be liable?

I'm going to assume you meant 'Spain', not 'Spam' in the first instance.

First, criminal jurisdiction can be different than civil jurisdiction, but what generally would happen is that the diplomats in Korea and Spain would conference to determine jurisdiction. China would have limited involvement, as 'spam' is a lower offense than hijacking a system. Anyways, determining jurisdiction would be a complicated, diplomatic, and political game. For example, Spain would likely refuse to extradite if Korea has substantially higher penalties for the hijacking.

On the whole though, the likely outcome would be that the spammer is tried in Spain, where HE was when he committed the crime, under spanish law, with evidence provided by Korean authorities. For countries unwilling/unable to do this, this is where 'diplomatic incidents' can start happening, up to embargos, special military ops, and in the case of the USA, invasion of the offending country in question*.

Even for crimes committed IN the country, where the person then successfully flees back to their home country, it becomes a matter of 'extradition', and you're often stuck essentially trying them again in their home contry to get them back.

Falling back to civil cases, as Spamhaus mentions, 'settlement schmettlement', they have no assetts in the USA and British authorities won't accept any US default judgement without it going through THEIR court system, which means that e360 would have to hire an english barrister to argue before the court.

I tend to liken Spamhaus's activities to be a bit like operating a mail order business. It's not the mail order business's responsability to ensure that their services are legal in the country they ship things to, it's the purchaser's.

Here in the USA, for example, let's take the tainted chinese drywall. Here's the general lawsuit chain:
1. Homeowners hire builder/remodeler who used the drywall. If builder/remodeler is unavaiable(bankrupt, out of business), skip to #2
2. Builder/Remodeler sues the distributer
3. Distributers sue the importer.
4. The Importer sues the maker of the chinese drywall(or reaches a settlement) in chinese court.

Though I think they're collecting up all the homeowners and such into a class action against the importing company.

*Off the top of my head, I remember us doing this THREE TIMES.

Re:What's more outrageous...

[Anonymous Coward]

They did not "originally show up". Get your facts straight.

They did to have the case moved to federal court, when the judge declined their request they walked out. Get *YOUR* facts straight. As an RBL operator I have been following the case closely since it inception, I think I know what happened as I have read all the documents!

distasteful and counterproductive corpspeak

[Onymous Coward]

I think it is important to note that Spamhaus is a service that people proactively utilize.

If we're inventing new terms, let's have them be sensible? "Proactive" and "utilize" (in this sense) are both pretty bad.

Proactive is just about redundant and doesn't exactly convey the sense that's intended. A person being proactive isn't "in favor of being active", they are "taking initiative". It's nice to have a simple term to express this, but let's invent something other than "proactive".

When one "utilizes" something they cause that thing to become ("-ize") useful ("util-"). They're not merely using it. They are converting or applying something so that it can be productive or effective where in its former state (unconverted or not thus applied) it was not. Spamhaus lists? Already useful.

It is important to note that Spamhaus is a service that many people take the initiative to use.

I know these terms have been around and aren't being invented here at this moment. I'm saying they're neologisms (or maybe in utilize's case a "neosemantism") that are best not promoted. The more you conflate meaning or get vague with meaning in language, the stupider you make us all. If you're going to change language, do it in an intelligent way. Please don't push us towards an idiocracy.

Re:It isn't a fine.

[farnz]

You miss something important that applies in both directions; when a Brit brings their judgement to the US, or an American brings their judgement to the UK, it's not automatically enforceable (as a judgement from New York state would be in an Illinois court). If I (a UK resident) were sued by e360 in Illinois, judgement was granted, then e360 tried to get it enforced here, I would be able to argue in the UK that I didn't show up because the Illinois court has no jurisdiction over me. If the UK court buys my argument, the judgement cannot be enforced over here, and e360 would have to sue me again in a UK court to get at my assets. Of course, if I brought assets into the US, they could be seized to pay my US debt; I'd have to be careful to not bring things over.

Same applies the other way round - if my local court rules that e360 owes me £1,000,000 because they don't show up, and I try to get it enforced in the USA, e360 could argue jurisdiction when I arrive in Illinois. If the US court agrees with e360, my UK judgement is unenforceable in the US, and I have to get a fresh US judgement to get at any US assets of e360; again, if they bring assets into the UK, I can have them seized under my UK judgement.

Re:What's more outrageous...

[Rabid Anti Spammer]

No problem, there was a lot of mis-information in this by all concerned (particularly E360 Insight and the press.)

Here's a lawyers comment confirming what I said (and one of the places I got the info): http://blogs.securiteam.com/index.php/archives/664