Quick news from the E360 case

(via usenet)

The audio transcript of the damages hearing in the E360 case is available as an mp3 file: http://www.ca7.uscourts.gov/tmp/8K0VUL4K.mp3

The money quote at 19:20 into the recording:

I have never seen such an incompetent presentation of a damages case, it's not only incompetent, it's grotesque. You've got damages jumping around from 11 million to 130 million to 122 million to 33 million. In fact the damages are probably zero

Linhardt drops the other shoe

Or the fourth shoe. Whatever. Who's counting?

Two weeks ago, I wrote about how E360 had dropped their third SLAPP lawsuit against Susan Gunn, Mark Ferguson, and Kelly Chien. E360's tactic seems to be to file unwinnable but expensive nuisance lawsuits against Gunn et al, and then drop the lawsuit at the last minute, allowing them the ability to file yet again later on. The theory being, I suppose, that you can hurt your victims more by dragging them into court repeatedly than by dragging them into court once and seeing it through to the end.

At the time, I speculated as to what Linhardt had planned for the next time.

I didn't have long to wait, as within days, Linhardt slapped Gunn with yet another subpeona. At Susan's request, I've not mentioned it until now, but her lawyer has given her the go-ahead and so you may now read it in her post on usenet.

I'll let you read it for yourselves, but in a nutshell, they demand that she cough up everthing she knows and every piece of documentation she has on the inner workings of Spamhaus.

The subpeona seems to be void on jurisdictional grounds, so it's unlikely that E360 will be getting anything from Susan.

E360 files third SLAPP suit against Susan Gunn and others

Three days ago, I asked rhetorically where E360 gets the money to file all these harassing lawsuits. That question becomes more serious with the news that Linhardt has filed yet a third lawsuit against Susan Gunn along with Mark Ferguson and Kelly Chien.

Details of the lawsuit can be found at SpamSuite. In a nutshell, it's the same lawsuit as before, claiming defamation because the defendants called them spammers.

There's no way that E360 can win this case on the merits given the abundant evidence of their spamming, and even Ferguson's proof that E360 falsified opt-in records. This is clearly just another lawsuit intended to harass anti-spam activists.

One major question: How many times are the courts going to allow Linhardt to keep re-filing the same lawsuit before they put a stop to it.

Where is the money coming from?

This brings us to the question: Where does E360 get the money for all these lawsuits? The one against Comcast certainly will go nowhere unless E360 spends significant money pursuing it.

One theory I've heard is that, like the Mark Felstein lawsuit against Spamhaus in 2003, this lawsuit is quietly being backed by a coalition of spammers. In this case, the spammers are hoping for a legal precedent which will force Comcast, and by extension other ISPs, to accept spam without any blocking.

Loss and victory for Spamhaus in court

As reported at SpamSuite, the 7th Circuit has ruled on Spamhaus' appeal. In a nutshell, the default judgement against Spamhaus has been upheld, but the damage award and the injunction are overturned.

What this means is that because Spamhaus didn't bother to defend themselves (previously arguing that Illinois courts didn't have jurisdiction over them), they've lost the case by default. This can no longer be argued in court, nor can jurisdiction. This was to be expected; it would have taken extraordinary circumstances for the court to reverse the default judgement.

However, the judge has ruled that the $11M+ judgement against them was excessive, and so everybody goes back to court to argue damages. It's impossible at this time to predict what the damages will finally be.

In addition, the injunction against listing E360 as a spammer has been lifted. As long as Spamhaus can show new evidence of spamming (which is trivial to do), we can expect the E360 SBL entry to return.

Update: John Levine has a better and more detailed analysis.

Mark Ferguson's affidavit and other legal docs in the E360 case

Just a few items worth mentioning from the SpamSuite web site.

Most interesting, is Mark Ferguson's affidavit in support of Spamhaus' motion to dismiss on jurisdiction. Nothing unexpected here; it contains his assertions that he does not live in Illinois or do business there, and that E360Insight was definately sending him spam. Exhibit VII is the most interesting, as it contains a claim from E360 that they had the signup information for Ferguson. The problem is, the alleged signup information uses a bogus IP address, indicating that it was forged after the fact.

E360 apparently sells affiliate status to other spammers to force removal under injunction

(See the tag "E360" for more background on this story. In short, E360 Insight has obtained a court order forbidding anti-spam organization Spamhaus from listing E360 or any of its properties as a spammer.)

In April, I commented on E360's request that Spamhaus be forced to remove listings based entirely on E360's word that they owned the listed domain. Spamhaus noted that this would in effect allow E360 to sell affiliations to any spammer that wanted to be removed.

A week ago, I observed that E360 seemed to be advertising just such a service.

Well, as of today, Spamhaus has filed notice to the judge that E360 has done exactly that.

On June 15, 2007, counsel for e360 wrote counsel for Spamhaus and demanded that Spamhaus remove from its list of known spammers certain IP addresses owned by a company named Virtumundo. ... e360’s June 15 letter asserts that Virtumundo is a customer of and doing business with e360, and that e360 has contracted with Virtumundo for network management and eMessaging services...

The service agreement between E360 and Virtumundo makes it clear that neither company has any ownership interest in the other, and that E360 is merely acting as a service provider. One cannot help but suspect that the "service" E360 is actually offering is the removal of Spamhaus record SBL41635.

Full text of Spamhaus' notice to the court, and their exhibits, including a copy of the agreement between E360 and Virtumundo can be found at Spamsuite.

Update: Direct magazine (email marketers' trade magazine) has an article about this, entitled "Linhardt Turns Spamhaus Court Order into New Service".

E360 advertising Spamhaus removal services

In April, I wrote about an interesting aspect of the E360 vs Spamhaus court case. E360 has obtained a court injunction which requires that Spamhaus remove E360 and all of their aliases from the SBL. However, E360 does not want to provide Spamhaus with a list of such aliases so that Spamhaus can comply, and they don't want to provide any proof of ownership of those aliases which they've informed Spamhaus about. In short, they want a blank check to contact Spamhaus at any time and demand the removal of any listing.

I pointed out at the time that giving E360 what they're asking for would enable them to go into the de-listing business. That is, anybody who wanted off the SBL could make a deal with E360 and E360 would then send a letter to Spamhaus claiming ownership of the domain in question and demanding its removal from Spamhaus' list.

Well, it looks like something similar is coming to pass. If you search for spamhaus on Google, one of the ads that comes up is this ad from E360:

Problems With Spamhaus?
Read how e360 helps clients verify
permission & remove SBL listings.
www.e360insight.com

The page linked by the ad consists of an attack on Spamhaus, and ends with "Contact us to learn how to verify permission and remove Spamhaus SBL listings"

Spamhaus, URIBL, SURBL under DDOS attack

This has been ongoing for a couple of days now. Spamhaus and two other major blocking list providers have been under a distributed denial-of-service (DDOS) attack. Steve Linford of Spamhaus believes that the source of the attack is the same people who executed the attack against Blue Security last year which effectively destroyed their Blue Frog anti-spam project.

Spamhaus has implemented anti-DDOS countermeasures and is weathering the storm. Uribl has closed up shop, redirecting their IP address to 127.0.0.1 until things blow over. (One wag has suggested that they redirect to 255.255.255.255 in order to get the attention of the ISPs hosting the zombies. Bit of network geek humor there.)

More information can be found in Linford's announcement on usenet news.

More on E360Insight vs Hacker X

Direct magazine, a news magazine for direct marketers has a little bit more on the story of the alleged cracker who broke into E360's systems and sent porn spam to nearly 300,000 people on one of E360's client's email lists. E360 CEO Dave Linhardt claims that they subsequently lost that customer's emailing business.

Linhardt also made sure to mention that two of the defendants in the SLAPP suit he filed against various anti-spammers live in the region where the cracker was operating, and that he believes the defendants have been helping Spamhaus, a defendant in another SLAPP suit he has filed.

Linhardt says that he's notified the FBI and other authorities of the break-in.

For an example of the cracker's work, see this wonderful Snopes article about the email alleging that folks with AIDS can fly Southwest airlines for free.

Other examples attacked with American Airlines and Wendy's Hamburgers.

Spamhaus®

ClickZ News reports that Spamhaus is now a registered trademark in Europe. This trademark was obtained with the permission and support of the Hormel corporation, the owners of the SPAM® trademark, who conceivably could have put up a fuss and opposed Spamhaus.

It's not immediately clear to me why Spamhaus needs a trademark, but I can imagine all sorts of nasty legal tangles this could avoid in the future. Kudos goes to Hormel for being so gracious about it all.

E360 vs Spamhaus news

Well worth visiting: http://www.spamsuite.com/node/72. (Spamsuite is a site which tracks legal documents in significant spam-related lawsuits.)

The documents in question deal with a request by E360 that Spamhaus show cause as to why they've listed more E360 IP addresses in defiance of a court order. Of particular interest is the allegation that Time Warner has terminated E360 for spamming, apparently due to the Spamhaus listing.

Spamhaus has responded that the listing in question was in response to spam sent from "Rocky Mountain Internet Services" which is anonymously registered in Florida, and that there was no identifying information tying it to E360. Additional spam came from "XO Communications", also registered anonymously in Florida. E360 asked Spamhaus to remove the listings, and Spamhaus asked E360 for evidence of ownership.

E360 has steadfastly refused to provide any proof of ownership of the affected domains, and also refuses to provide a list of domains to Spamhaus. Spamhaus says that the domains in question do not belong to E360, but rather to E360's business partners and are thus not subject to the injunction.

For these reasons, Spamhaus is asking the court for permission to conduct discovery to determine exactly what companies, domains, and IP ranges are owned or controlled by E360.

E360 in turn responded that it doesn't need to provide a list of IP ranges to Spamhaus and it doesn't need to provide any proof that it owns ranges it wants removed from the Spamhaus SBL. As exhibits, E360 provides documentation that Dave Linhardt is the owner of Rocky Mountain Internet Services and Bay City Hosting.


Essentially, E360 is arguing that Spamhaus should be required to de-list any domain which E360 tells them to de-list. The spamhaus affidavit points out that this could provide a windfall for any spam domain for whom E360 is willing to do a favor. For this reason, Spamhaus argues, they should not be required to de-list domains without adequate proof that they fall under the court injunction.

Now, one interesting fallout from this round of legal bickering is that E360 will be forced to provide proof that they own Rocky Mountain Internet Services and XO Communications. If they do this, then all spam ever seen from those domains could reasonably be folded into the case as proof that E360 are the spammers that Spamhaus has accused them of being.

Return Path editorial on why they joined the Amicus Brief in the E360 vs Spamhaus lawsuit

Believe it or not, there are legitimate email marketers out there.

As proof of this, note that marketing companies Return Path and Datran both signed on to the Amicus Brief that was submitted on behalf of Spamhaus last week. (This is remarkable when you consider that Datran was actually listed by Spamhaus less than a year ago.)

Matt Blumberg, CEO of Return Path published an online editorial today explaining their position. Joe-Bob sez check it out.

Amicus Brief filed in Spamhaus case

I last wrote about the E360 vs Spamhaus case last October. In a nutshell, spammer Dave Linhardt, CEO of E360 sued Spamhaus for listing him as a spammer. Spamhaus, based in England, declined to submit itself to the jurisdiction of a U.S. court, and Linhardt was awarded over $11M in a default judgement. Spamhaus is now appealing this judgement and arguing jurisdiction.

As part of this appeal process, a "friend of the court" brief (pdf, 58 pages) was authored by Matthew Prince (Adjunct Professor at John Marshall Law School and founder of Unspam) and co-signed by dozens of other interested parties. The list of signatories itself is fascinating, being composed of both anti-spam organizations such as CAUCE, and email marketers such as Datran.

In short, the brief argues that: There is no jurisdiction over Spamhaus in the United States. The judge erred in giving a default judgement before even settling the issue of jurisdiction. The internet would be badly harmed if a precedent like this were set. The decision to block emails based on Spamhaus' data is made by individual ISPs and not by Spamhaus — thus holding Spamhaus liable for the decisions made by others based on the information Spamhaus provides would be akin to holding movie reviewers liable for a film's failure. The CAN-SPAM act specifically grants immunity to ISPs for their efforts to block spam. The OptinRealBig case extended CDA protections in such cases to services such as Spamhaus. The permanent injunction issued by the court would create a legal standard and process that is unworkable and would thwart any attempts by ISPs to block spam.

More on this story in Direct Magazine article Well-Known E-mailers Back Spamhaus in Amicus Brief.

Oh, one interesting tidbit of trivia that's come to my attention in this case: The judge who issued the default judgement in this case is himself a user of Spamhaus — he just doesn't realize it.

... in fact, the email addresses of all United States federal court judges and employees are currently protected from undesirable "spam" email by a filtering system utilizing Spamhaus' SBL list.

More on Spamhaus ZEN

Yesterday I wrote about how Al Iverson had observed zero false positives from using the Spamhaus ZEN blocking list. I also noted that the sample set was too small (~2300 emails) to definitively give Spamhaus the Zero False Positives Seal of Approval.

Today, numbers provided by the Dutch ISP XS4All were brought to my attention.

In a nutshell, before ZEN, XS4All was using a combination of SBL + XBL + dynablock.njabl.org (ZEN is simply a combination of the SBL, the XBL and the PBL). With this combination, they were blocking about 4 million messages a day, out of 8 million examined. Their abuse@ address receives complaints about false positives about once every two weeks. Assuming that only one false positive in a thousand actually generates a complaint, that's a false positive rate of .00089%. Not too shabby.

(Of course, the one-complaint-in-a-thousand number is plucked straight from the air; I have no idea if anybody has ever done a study to find the actual number, but I think it's a reasonably conservative guess.)

The full article (in Dutch) can be found at Vincent Schönau's blog at XS4All.

Spamhaus ZEN: 80% blocking rate, zero false positives

As reported yesterday in Al Iverson's SpamResource web page:

Iverson was becoming overwhelmed by the spam sent to his abuse address. For obvious reasons, it's a very bad idea to filter an abuse-reporting address because legitimate abuse reports are too easily mistaken for spam.

As an experiment, Iverson applied the the Spamhaus ZEN blocking list to his incoming abuse mail — to tag rather than block.

(Spamhaus ZEN is a merger of the three blocking lists maintained by Spamhaus, and thus should be the most aggressive of them all.)

Iverson's results: out of over 2200 spams received in February so far, nearly 80% would have been blocked by Spamhaus, and there were zero, none, nada false positives.

This is encouraging news for administrators who worry if it's safe to use a blocking list. More testing is required though before it's safe to give Spamhaus the Zero False Positives Seal of Approval. At the very least, we need to see results from a variety of different users, and we need to see the results applied to a corpus of many more than 2200 messages.

Top Ten Worst Spam Offenders

This has been making the rounds for the last week or so, but perhaps you haven't seen it yet. In short, Spamhaus has released its top-ten spam offenders for the year. There are actually three such lists, one for worst countries, one for worst ISP, and one for worst spammer.

Of the worst countries, the U.S. leads, of course, with roughly 6 times the spammers as its nearest rival, China.

The winner for worst ISP — to nobody's surprise — is UUNet, now known as Verizon Business, leading with more than twice the spammers as its nearest competitor.

Of the worst spammers, Russians and Ukranians occupy six of the top ten spots, with Alex Polyakov (likely a pseudonym) leading the list. Polyakov is most known for mortgage spam, but also advertises child porn, money laundering, and drugs. He may also be the person behind the DDOS attack that brought down Blue Security in May of this year.

So, from reading the articles, I think that the majority of all spam could be stopped if just a few things would happen: 1) Russia starts going after its own criminals*, 2) Verizon fires the management team of Verizon Business, 3) ISPs start blocking outgoing email from their zombie customers, and 4) Microsoft does something about the piss-poor security of their operating system*.

Daily Tech has some good coverage of the story, with more information from Sophos and a lively discussion thread.

Groklaw coverage of e360 v Spamhaus

Groklaw has picked up the e360 vs Spamhaus case and has some good analysis of it. See Spamhaus is on the move...Ditto e360insight

Small victory in Spamhaus case

Judge Kocoras has denied e360's request for another sanction without Spamhaus even having made a single filing. In a nutshell, the judge has ruled that e360's request is overbroad and excessive.

In its moving papers, e360 requested three forms of relief for the claimed noncompliance: first, suspension of Spamhaus's domain name until it complies with the terms of the injunction; second, steps to prevent third parties from accessing Spamhaus's technology or permission to add them as defendants to this suit if they continue to do so; and third, a monetary sanction against Spamhaus for each day that it fails to comply with the injunction. When e360 appeared in court to present the motion, we noted the breadth of the requested relief and directed e360 to submit a draft order that was more tailored.

The proposed order is limited to only the first remedy, suspension of the domain name by The Internet Corporation for Assigned Names and Numbers ("ICANN"), the entity responsible for coordinating unique identifiers used for Internet communication, or Tucows, Inc., the registrar through which Spamhaus obtained ts domain name. Neither of these outfits are parties to this case. Though more circumscribed than the preceding request, this relief is still too broad to be warranted in this case. First, there has been no indication that ICANN or Tucows are not independent entities, thus preventing a conclusion that either is acting in concert with Spamhaus to such a level that they could be brought within the ambit of Fed. R. Civ. P. 65(d). Though our ability to enforce an injunction is not necessarily coterminous with the rule, the limitations on its scope inform an exercise of our power to address contempt. See, e.g., Rockwell Graphic Systems, Inc. v. DEV Industries, Inc., 91 F.3d 914, 920 (7th Cir. 1996). Second, the suspension would cut off all lawful online activities of Spamhaus via its existing domain name, not just those that are in contravention of this court's order. While we will not condone or tolerate noncompliance with a valid order of this court, neither will we impose a sanction that does not correspond to the gravity of the offending conduct.

This is consistent with my earlier comments about the judge — he didn't rule against Spamhaus out of cluelessness, as some people have suggested, but simply because when the defendant doesn't appear in court, he doesn't have much choice. Now that Spamhaus has decided to play along and challenge jurisdiction, things will be very different.

Here's to hoping there will be sanctions against e360, although my own experiences, and Spamhaus's earlier experiences have shown that this is unlikely.

Update: Here's a copy of the ruling. Looks like it was produced by some sort of OCR.

Spamhaus gets new legal counsel

Word on the street is that Spamhaus has obtained new legal counsel in the e360 case. On Friday, documents were filed in Illinois which have the effect of preserving their right to appeal. This part of the story is pretty minor news.

The big news, however, is that their new legal counsel is Jenner & Block, one of the top firms in Chicago, who have agreed to take the case Pro Bono. The lead attorney on the case, Matthew Neumeier, is a senior partner at the firm, former Supreme Court clerk, and an Adjunct Professor at The John Marshall Law School, where he teaches graduate courses on High Technology Litigation and Computers & the Law.

As one observer put it: "I would imagine, for the e360 attorneys, getting notice that Jenner is on the case is a bit like being an amateur boxer who strolls into the ring down at the local YMCA only to find not only are you fighting a young Mike Tyson, but he's decided to fight for free just because he wants to see you crushed."

Update: Covered by Computerworld.

U.S. Judge may order ICANN to yank Spamhaus domain

As I reported last month, Atriks partner David Linhardt filed an $11M defamation lawsuit against Spamhaus for listing him as a spammer. Spamhaus declined to defend themselves, arguing that U.S. courts do not have jurisdiction over a U.K. organization

Unfortunately, the legal system has a nasty catch-22: You can't just claim that a court doesn't have jurisdiction over you; you need to go to that court and convince it that it doesn't have jurisdiction. Otherwise, the court will assume it does have jurisdiction and act accordingly. (For example, earlier this year, I spent many thousands of dollars in legal costs proving to a court in North Dakota that North Dakota did not have jurisdiction over me in California.)

It's an ugly situation. Any time a rich plaintiff wants to use the court system to attack a poorer defendant with a SLAPP suit, neither truth nor jurisdiction is a defense. One way or the other, that defendant is committed to spending money they don't have defending a case that should never have been filed in the first place.

Since spamhaus declined to defend themselves in Illinois, the judge had no choice but to find for the plaintiff. Last month, the judge awarded $11M to Linhardt. Of course collecting will be another matter, as Spamhaus has no assets to seize in the U.S.

Now in retrospect, it looks like Spamhaus received less than stellar legal advice. By ignoring a court — even a court that arguably does not have jurisdiction — Spamhaus have now put themselves in contempt. If they ever do appear, either to argue jurisdiction or fight the case on its merits, they will have put themselves in the unenviable position of appearing before a judge who's probably rather annoyed at them right now.

Which brings us to the present: Not surprisingly, Judge Kocoras is not amused by Spamhaus' refusal to respect his authority and is now considering a proposed court order (pdf, 2 pages) which would order ICANN and Spamhaus' registrar to suspend Spamhaus' domain name, effectively disconnecting them from the internet.

From here, the future is too muddy to forsee. ICANN might decide, as an international organization, that a U.S. court does not have the authority to order it to suspend a registration. If this happens, the battle is taken to a new level as the various sides argue over whether or not ICANN is subject to U.S. law. If ICANN caves and obeys the court order, or if they lose a jurisdictional battle, a new international battle will begin over who controls ICANN. The United States only barely managed to retain controll of ICANN in response to international pressure. If ICANN winds up suspending the registration of a U.K. organization due to the order of a U.S. court, we can expect to see a new movement to have ICANN removed completely from U.S. control.

And if the spammers succeed in removing Spamhaus' registration, what then? First of all, we can expect to see Spamhaus re-open with a .uk registration. Every service provider which depended on Spamhaus for help with their spam filtering would be forced to update their software to make use of the new domain name.

Spamhaus may or may not decide to come to the U.S. to fight the case in Illinois. If so, they face an uphill battle. Whether they fight the case on jurisdiction or on its merits, my own personal experience shows that this will be a very expensive fight. (If this happens, expect calls for a defense fund on this and other forums.)

If Spamhaus continues to ignore the U.S. courts, they may find themselves subject to criminal contempt charges. Although not enforceable in the U.K., it could mean a very uncomfortable time for any Spamhaus officers if they should ever choose to trave in the U.S..

Just how fucked are we anyway?

I believe we are in nothing less than a fight to save the internet. Twelve years ago, spammers discovered Usenet and flooded it with spam until it was useless to regular users. Usenet was effectively destroyed by the spammers.

Having stripped Usenet to the bones, the locusts spammers have moved on to email. While not dead yet, email is clearly being destroyed as well. Every week I hear more and more stories of people who are abandoning email because the spammers have made it useless. The spammers themselves have seen this coming and have already moved on to blog comment spam, message board spam, and phone spam.

We are now in a situation where spammers have learned that they can cripple or even bring down spam-fighting organizations by filing frivolous lawsuits or launching DOS attacks. Witness what happened to MAPS, Blue Security, and Osirusoft.

As long as the courts — especially U.S. courts — give spammers free rein to abuse the legal system without repercussions, the situation will continue.

What needs to happen, and soon, is for the ISPs to start giving some real support to the volunteer anti-spam activists on whom they depend. The courts need to start holding spammers accountable for the frivolous lawsuits they file. The legal system needs to pass some anti-spam laws with real teeth (hint: use European anti-spam laws as a model.) Spam-friendly ISPs need to be held accountable along with the spammers they harbor.

Some years ago, anti-spam activists declared a moratorium on their scanceling activities which were keeping Usenet functional. For one week, no spam was cancelled. Not surprisingly, Usenet was immediately brought to its knees by spam. Many servers crashed outright under the load.

If the spammers succeed in shutting down the anti-spam organizations of the internet, we can expect to see email collapse in a similar way, but this time it won't be for just a week.

Further reading

Spamhaus legal answers

Ars Technica: Court likely to order ICANN to suspend Spamhaus' domain.

Securiteam blog: Article by Gadi Evron and legal analysis by Mathew Prince.

Slashdot: Perspectives on Spamhaus's Dilemma.

Computer World: Illinois court threatens Spamhaus with shutdown.

Section 230 of the Communications Decency Act, USC 47 § 230 (c)(2) seems to cover actions taken in good faith to block objectionable material.

Google Groups search for 60035 "box 1132" group:*.sightings in .sightings returns many examples of e360 spam.