Yes, you can fight spam — part 1

Last week, I wrote about a study conducted by researchers at the University of California on the economics of spam. They had determined that the spammers were obtaining a conversion rate of less than one in twelve million from their botnet-sourced spam. That is, the spammers had to send twelve million spam emails for every customer they snagged.

I concluded that "just hit delete", educating the users, improved filters, or trying to use the legal system just were not going to work to stop spam.

This week, I'm going to talk about something that apparently does work: not tolerating the bad actors responsible.

If you follow spam issues in the news, then you may have heard of the takedown of a black-hat ISP in San Jose, California known as "McColo". You can read all about it in Brian Kreb's Washington Post article Major Source of Online Scams and Spams Knocked Offline.

In a nutshell, McColo was one of the prime bad-guys of the internet. Child porn, phishing, credit-card processing for criminals, you name it. We're talking the Dr. Moriarty of the internet here. As part of all that, they were knowingly hosting the command-and-control centers for major botnets.

McColo had been well-known to a number of internet security experts and spam-fighters. Attempts to get them disconnected by their upstream providers, Hurricane Electric and Global Crossing had long fallen on deaf ears. Finally, it reached the point where their support of McColo was going to reach a wider audience. Faced with a public shaming, they finally did the right thing and gave McColo the boot.

Here's what's significant: The shutdown of McColo resulted in a 60-70% drop in spam worldwide overnight.

Let me say that again: A 60-70% drop in spam overnight. Worldwide. From disconnecting just one bad actor.

This chart, courtesy of SpamCop shows it best:



Other spam-tracking sources are reporting similar reductions in spam. It is reported that detections of the Srizbi botnet (the biggest, at 60 billion spams/day) are down by up to 95%. Similar reductions in activity have been seen in several other botnets, including Mega-D, Bobax, Rustock and possibly Asprox.

I don't have any illusions that this drop is permanent. The spammers and bot-herders will be looking to rebuild their networks almost immediately. I've already noticed an increase in virus spam lately, as have others.

(Note: This may be a good time to remind your friends and relatives not to click on any attachments they receive — especially anything in a .zip file.)

Also unfortunately, McColo had a backup plan in the form of Swedish internet service provider TeliaSonera who, not knowing what was going on, left McColo connected to the internet. McColo was savvy enough to wait until the weekend before taking advantage of their backup connection. The problem was discovered within hours, but getting them disconnected again required CEO approval, which took even more time. All told, McColo was back online for about twelve hours. Enough time, unfortunately, to transmit botnet control updates to servers in Russia. More details can be found in the U.K. Register.

It will probably take time for the spammers to get the botnet up and running, but we should see spam levels begin to rise again shortly.

Other articles on this takedown:

• Washington Post: Major Source of Online Scams and Spams Knocked Offline
• Washington Post: A Closer Look at McColo
• HostExploit: McColo Cyber Crime USA (pdf)
  
• HostExploit: McColo Supplement (pdf) — details McColo's reconnection and Russian connections.
• Washington Post: Spam Volumes Drop by Two-Thirds After Firm Goes Offline
• Washington Post: Answers Trickle Out as Spammer Networks Remain Compromised
• UK Register: Dead network provider arms Rustock botnet from the hereafter — article about McColo's brief reconnection via Telia Sonera.
  

Next: You can fight spam by disconnecting bad actors

Tools in the fight against spam

I'm on the fence about whether I should mention some of these tools or not, as there are those who consider fighting abuse with abuse to be a bad thing. The other school of thought is that it's ok to defend yourself when you're attacked by spammers.

This post is a living post; I'll be adding to it as time goes on. Perhaps later I'll replace it with a link to a static page.

• Sender Score — Call themselves "The world's most comprehensive database of email sender reputation". Use it to check out your own business and make sure you're staying out of the anti-spam blacklist.
  
• Wpoison -- The oldest one I know of. This is a cgi script that generates bogus web pages on demand. Each page is filled with giberish, fake email addresses, and links to more wpoison pages. The idea is that email address harvesters will harvest the fake email addresses and poison the spammer's database. This is a very old script and may no longer be effective. It also has the potential to poison the databases of search engines, which is an undesirable side effect. The search engines are likely to drop your entire site from their crawl in response, which is probably something you don't want. Protect the search engines (and yourself) against this by installing a proper robots.txt file along with wpoison.
• Spam Poison -- Seems to be a commercial reincarnation of wpoison. They provide you with a tagged url to place in your web site which redirects harvesters to their web site. Not clear how they make money (if any) from this. Also, the links have "spampoison.com" in the clear, so I would think that the harvesters will have learned to ignore those links by now.
• Spam Gourmet -- One of my favorites. They provide email addresses with short lifespans to use anywhere you're required to give an email address to strangers. Their basic service is free and fairly easy to use. You sign up with them and get an email address in their domain. Then, whenever you need to enter an email address on a web page, you enter one in the form userid.N.cookie@spamgourmet.com. The cookie is anything you want to use for that web site, and N is the maximum number of emails you're willing to receive. The first N messages are forwarded to you. After that, it becomes a black hole, never to contact you again. You don't even need to visit the spamgourmet.com web site after the initial signup. The only tricky part is coming up with cookies you haven't used before.
  
• Spam Decoy.net — Disposable email accounts (not yet reviewed).
• SiteAdvisor -- Provides two services: First, they seed web forms all over the internet with tagged email addresses to see which ones get spammed. Second, they visit sites with potentially malicious software to see which ones download malware onto their computers. They then make this database available under the creative commons, and provide warnings while you surf. Visit their web page for a short animated demo. See my review above.
• Spam Cube -- A hardware solution to spam. Similar to a firewall box, Spam Cube sits between your computer and your network, filtering out spam as it arrives. Presumably, its filters are regularly updated remotely by the vendor. Like a firewall box, Spam Cube is configurable via a webbish interface. See International Herald Tribune review.
• SpamFighter — Collaborative anti-spam tool for Windoze. Click on a piece of spam that the filter missed, and the spam is removed from everybody's inboxes simultaneously. Not being a Windoze user myself, I haven't tried it out.
  
• SpamSieve -- Bayesian filter software for Mac OS X. $25. 30-day trial available.
  
• SpamPal -- Filter program for Windows. Runs between your mailbox and your mail program, tagging incoming mail as spam if the sender is found in a DNSBL database.
• SpamAssassin -- Similar to SpamPal, but for Unix/Linux. A perl program launched from procmail which tags spam based on multiple criteria, including DNSBL listings.
• Blue Frog -- Subscription service which maintained a do-not-spam list and complains to spammers on your behalf. Driven out of business by a denial-of-service attack in 2006.
• TattleMail -- Subscription service which automatically analyzes your spam for you and sends complaints to the proper authorities. $1/month. See ClickPress review.
• FormFlood -- A program written to fill web-based forms with gibberish. Nominally intended to load-test servers, it can also be used to poison a spammer's leads database. Here's how it works: A spammer (say a mortgage spammer) floods you with spam asking you to fill out a form to apply for a mortgage. (In reality, this information is simply sold to mortgage brokers, who will contact you later.) FormFlood lets you fill out the spammer's form thousands of times with reasonable-looking gibberish. This wastes the time of the mortgage broker who hired the spammer and makes the spammer's leads worthless. Soon, that spammer is out of business. Poison the databases of enough spammers, and the mortgage broker who hired them starts looking for more legitimate ways to run their business.
• PhishFighting.com -- Similar to FormFlood; this site allows you to report the URL of a phishing site, which is then flooded with bogus information. The phisher is then unable to find the useful information in the flood of useless data.
  
• Spam Vampire -- This is a program intended to suck down all of a spammer's bandwidth. In short, if enough people run it, it creates a distributed denial of serivce (DDOS) attack against the spammer's web site. It's written in javascript and runs right in your browser. You installing it by downloading the source code (which is an html file) onto your local disk. You configure it by editing the web page to point at a web page owned by the spammer that's annoying you, and by disabling caching in your browser. You run it by simply viewing the web page in your browser. If you like, you can even simply view the web page directly from the spam vampire web site, but then it attacks the spammers that Darren Brothers chooses instead of the ones you choose. The instructions seem to be directed at Windows users, but it probably runs under Mac and Unix/Linux as well. I haven't tried it myself
• Refi Retaliator -- Another program intended to poison the leads database of a mortgage spammer.
• Lad Vampire -- Coordinates DOS attacks against spammer web sites, similar to Spam Vampire.
• Cloudmark -- Community-based anti-spam service.

Links to many spam-fighting tools and tutorials can be found at Spam Huntress' web page.

Musings on the Phillips vs NetBlue case

I've been taking a random walk through some of the legal documents in the Phillips vs NetBlue case and reading some of the on-line comentary.

For those of you just tuning in, the gist of the case is this: Ritchie Phillips, owner and operator of a small ISP is suing mass marketer NetBlue for spam.

What makes the case interesting is that very little of the spam was sent by NetBlue themselves. Instead, they operate an affiliate program in which other people or companies drive business NetBlue's way and take a cut of the action. NetBlue can then distance themselves from the spam, effectively saying "Hey, not our fault; we told them not to spam." Nudge, nudge, wink, wink.

NetBlue does in fact have an anti-spam policy in writing, but they tend to enforce it very laxly. Choosing, essentially, to wait until a verified complaint comes to them, and then terminating only the affiliate responsible. Evidence in the case suggests that NetBlue in fact only terminates those affiliates who weren't bringing in much money anyway.

NetBlue has been in and out of SpamHaus listings over time, and for a while SpamHaus was working with NetBlue to help them solve their problems. After a while, SpamHaus decided to stop acting as NetBlue's help desk gratis, and to stop playing whack-a-mole. I suspect that they realized that NetBlue had no intention of taking any real action to stop the spam and were simply trying to appease SpamHaus to buy time.

At any rate, this placed Phillips in the position of suing NetBlue not for spam they sent, but for spam that was sent by their agents. This is a trickier case to win, because it means explaining a more complicated system to both judge and jury. It means explaining the mechanism of affiliate spam, redirectors, temporary web sites and so on.

Now there's no doubt that spam was sent, that it probably violated the CAN-SPAM act, and that it was sent on NetBlue's behalf. What remains to be seen is if the dots can be connected clearly enough for the court to see.

NetBlue's court arguments have been very interesting. For example, they've charged that Phillips failed to preserve evidence as is required. In particular, the spams in question often included embedded images and links to redirector pages. Although phillips saved the actual spams themselves, he didn't download the images or capture the contents of the redirector pages. This information would have strengthened the link between NetBlue and the spam.

Phillips responded that requiring an ISP to not only preserve all the spam it received, but to also follow all the links in the spam and preserve copies of the web pages to which it linked would be an impossible burden. In addition, the law only requires that you preserve the evidence you have — which Phililps has done — but does not require that you go out and gather more; it is only necessary to have the evidence sufficient to prove your case. Furthermore, since the images and redirectors were on servers controlled by NetBlue or its affiliates, it is NetBlue which failed to preserve evidence, not Phillips. Finally, Phillips points out that the missing evidence was material which would have helped his case, not NetBlue's.

Anyway, if you'd like to read some of the documentation yourself, it can be found at hypertouch.com. One thing is clear; NetBlue's lawyers intend to fight this and make it expensive for Phillips to pursue.

Other readings:

• Steptoe & Johnson llp: Court Rules that Failure to Mitigate Has No Impact on CAN-SPAM Awards — NetBlue argued that Phillips didn't do enough to mitigate the damage they caused, and the case should be dismissed on those grounds. The court ruled that the doctrine of mitigation of damages does not apply to statutory damages.
• Spam Kings; Spammers Can't Hide Behind Affiliates — Microsoft won a default judgement against Robert Soloway and his company, Newport Internet Marketing. Soloway had tried to redirect the blame to his affiliates. (See also his O'Reilly article.)
• The Inernet Patrol: CAN-SPAM Smack Down for Spammers Hiding Behind Affiliates — more discussionon the McCain ammendment which makes marketers responsible for their affiliate spam.

Hidden costs of spam

It seems that not a month goes by without some article in the media estimating the costs of spam to industry. The Washington Post estimated the cost of spam at more than $10 billion dollars per year in 2003. By 2005, Information Week had estimated the cost to be more than $21 billion. I've seen estimates as high as $50 billion. Enter "cost of spam" into Google search and you'll find thousands of similar articles.

Several sites even provide cost of spam calculators where you enter demographics about your company and the calculator tells you how much spam is costing you.

Now, estimating the cost of spam is an inexact science* at best, and every pundit probably has their own way of coming up with their numbers, but that's not what this article is about. Instead, I want to talk about the costs you can't translate into dollars.

There were two seperate articles this last week that illustrate my point. The first, from the Sacremento Bee, Spam defenses get overly aggressive, talks of a user who lost a number of important emails to false positives in a spam filter.

False positives are one of the biggest problems caused by spam. The enormous load of spam we all face means that spam filters are pretty much a fact of life for most of us. And spam filters mean false positives. Better spam filters mean more aggressive filter-evading techniques by the spammers, which lead to more aggressive spam filters, which leads to more false positives. We'd all like to think that the perfect spam filter is out there, waiting to be invented by some AI graduate student, but I believe -- for reasons that might merit a post of their own -- that such a filter is impossible. And thus, the false positives.

Every month or two, I take a few hours off and dig through the mail folder into which the spam was dumped, looking for names and subjects that signify false positives. Oh, my old college buddy was in town last week? Looks like I missed him; too bad he used the wrong keyword. Problem with an eBay transaction? Too bad it looked like a phishing attempt. My cousin needed a college loan? Well, the world needs ditch-diggers too. A beautiful woman saw my profile and wants to meet me? Oh, wait, that one was spam.

Spam causes us to lose wanted messages along with the spam; either through false positives in an automated filter, or just hitting delete one too many times and not noticing.

The second article to catch my eye was in PC World. The article, Spam Mutates, starts off with the tale of a blogger who threw in the towel because he was sick of fighting the blog spam.

That's another cost of spam -- it drives good content off the internet. Until the 90's, usenet was a fantastic fountain of knowledge and ideas. After the spammers flooded it, a lot of the worthwhile content went away as authors gave up trying to compete. Now we see bloggers who are frustrated with the constant fight against blog spam.

Lately cell phone spam has become a problem, and there were several articles in recent weeks about how the problem is expected to increase. If the cell phone companies can't find a way to combat this -- and I'm betting they won't -- we can expect to see users abandoning text messaging altogether as spammers make the service worthless. We may even see some real impact on the sales and usage of the phones themselves. I've already seen a similar phenomenon as land-line users abandon their phones because of all the telemarketing calls which have ruined the utility of conventional telephones.

About this blog

I've been blogging about spam since 1997 (before the invention of the word 'blog', actually, so I didn't call it that then.) There was no blogging software of course, so each entry required that I hand-edit the html of my web page and then use ftp to push it up to the server at http://www.rahul.net/falk. The rahul.net web site was started in 1997 thanks to Rahul Dhesi who generously donated the web space to the fight against spam. Among the several things I use the web site for is posting news articles about spam. Finally, in 2006, I enter the 21st century with actual blogger software (In the famous words by Homer Simpson "Oh, they have the internet on computers now!"). With a little luck, this will help me keep the blog more up to date than when I had to do it all by hand.

I've been chronicling spam since the summer of 1996. There were spammers before then, and small rogue service providers, but 1996 saw the rise of the first large rogue service provider: Earthlink. In the summer of 1996, Usenet began to be flooded with the vilest pornography spam. Explicit ads for rape pornography were everywhere, including in alt.sexual.abuse.recovery where you can imagine how unwelcome it was. Earthlink steadfastly refused to respond to complaints or do anything about the abusers. In fact, they went so far as to insist that the problem was very minor and that they hadn't received many complaints. To put the lie to their statements, I wrote an automated program which scanned alt.sexual.abuse.recovery for pornography spam from Earthlink. I then sent a daily report to Earthlink and posted it publicly as well. Earthlink could no longer deny the problem.

As time went on, I began to monitor more and more service providers and scanned more newsgroups. Every day I would send reports to the spamming ISPs and post a daily summary in public. By the time I ceased operations in 2001, I was monitoring over 400 ISPs and spammers.

I took great satisfaction every time a service provider responded and said that they'd discontinued service to a spammer. My .signature file had a '*' for every spammer kicked off the internet, a 'W' for every spammer's web site taken down, a '!' for every rogue site disconnected, and other symbols for other accomplishments.

But the sad fact is that we anti-spammers met with failure more often than success. The fact is that most ISPs don't care about spam. Given a choice between catering to a paying customer (the spammer), and a non-paying complainer, most businesses will give priority to the paying customer. To the bean counters, the abuse desk represents money rolling out with no reward. As spamming can be big business, a lot of money can ride on keeping the spammer happy. At least two major service providers -- AT&T and PSI -- have been known to write so-called "pink contracts" expressly exempting the spammer from the usual terms of service for a financial consideration (it's widely suspected that this is widespread and common). In most cases, the people who write the contracts and make the decisions are so far removed from the abuse desks that the abuse desks are powerless to do anything about the problem. And finally, I think that most large service providers secretly hope in their greedy little hearts that spam will become accepted enough in the mainstream that they can start spamming themselves.

Fighting spam is hard, miserable work. It can take weeks or months of work to get a spammer kicked off the internet, and they're usually back on-line at another service provider within days, pitting us against them in a never-ending game of whack-a-mole. Service providers are indifferent at best, and hostile at worst -- Uunet has been known to bring legal and other pressure to bear against anti-spammers. In 1997, Earthlink realized I was posting my reports from a company to whom they were a major customer. Tense and unpleasant meetings with my boss, human resources, and a couple of lawyers ensued. One bit of fallout was that I was shut down until I could find a service provider willing to host my web site.

The spammers themselves are naturally unhappy to see what they perceive as a bunch of bandwidth-hugging do-gooders interfering with their livelihood. If you're an anti-spammer, you can count on being sued from time to time. I've been thus threatened countless times, actually served twice, and am currently involved in a protracted lawsuit (topic for another post.) My co-defendant, David Ritz, has been sued four times. Spamming can be big business and some spammers have the resources to go after their victims with a vengeance. Anti-spammers are usually left on our own. The lawsuits never have any merit, but that's not the point -- the point is to hurt us enough with legal costs that we're forced to capitulate and drop out of the fight.

So I find myself today being sued over a web site I had barely even maintained in the last four years. If I'm going to be dragged back into the fight against spam, then so be it. The rahul.net web site had dropped from several posts per month to a few posts per year. Now it's time to roll up my sleeves, put the clothespin back on my nose, and wade in again.

I'm back.

U.S. Judge may order ICANN to yank Spamhaus domain

As I reported last month, Atriks partner David Linhardt filed an $11M defamation lawsuit against Spamhaus for listing him as a spammer. Spamhaus declined to defend themselves, arguing that U.S. courts do not have jurisdiction over a U.K. organization

Unfortunately, the legal system has a nasty catch-22: You can't just claim that a court doesn't have jurisdiction over you; you need to go to that court and convince it that it doesn't have jurisdiction. Otherwise, the court will assume it does have jurisdiction and act accordingly. (For example, earlier this year, I spent many thousands of dollars in legal costs proving to a court in North Dakota that North Dakota did not have jurisdiction over me in California.)

It's an ugly situation. Any time a rich plaintiff wants to use the court system to attack a poorer defendant with a SLAPP suit, neither truth nor jurisdiction is a defense. One way or the other, that defendant is committed to spending money they don't have defending a case that should never have been filed in the first place.

Since spamhaus declined to defend themselves in Illinois, the judge had no choice but to find for the plaintiff. Last month, the judge awarded $11M to Linhardt. Of course collecting will be another matter, as Spamhaus has no assets to seize in the U.S.

Now in retrospect, it looks like Spamhaus received less than stellar legal advice. By ignoring a court — even a court that arguably does not have jurisdiction — Spamhaus have now put themselves in contempt. If they ever do appear, either to argue jurisdiction or fight the case on its merits, they will have put themselves in the unenviable position of appearing before a judge who's probably rather annoyed at them right now.

Which brings us to the present: Not surprisingly, Judge Kocoras is not amused by Spamhaus' refusal to respect his authority and is now considering a proposed court order (pdf, 2 pages) which would order ICANN and Spamhaus' registrar to suspend Spamhaus' domain name, effectively disconnecting them from the internet.

From here, the future is too muddy to forsee. ICANN might decide, as an international organization, that a U.S. court does not have the authority to order it to suspend a registration. If this happens, the battle is taken to a new level as the various sides argue over whether or not ICANN is subject to U.S. law. If ICANN caves and obeys the court order, or if they lose a jurisdictional battle, a new international battle will begin over who controls ICANN. The United States only barely managed to retain controll of ICANN in response to international pressure. If ICANN winds up suspending the registration of a U.K. organization due to the order of a U.S. court, we can expect to see a new movement to have ICANN removed completely from U.S. control.

And if the spammers succeed in removing Spamhaus' registration, what then? First of all, we can expect to see Spamhaus re-open with a .uk registration. Every service provider which depended on Spamhaus for help with their spam filtering would be forced to update their software to make use of the new domain name.

Spamhaus may or may not decide to come to the U.S. to fight the case in Illinois. If so, they face an uphill battle. Whether they fight the case on jurisdiction or on its merits, my own personal experience shows that this will be a very expensive fight. (If this happens, expect calls for a defense fund on this and other forums.)

If Spamhaus continues to ignore the U.S. courts, they may find themselves subject to criminal contempt charges. Although not enforceable in the U.K., it could mean a very uncomfortable time for any Spamhaus officers if they should ever choose to trave in the U.S..

Just how fucked are we anyway?

I believe we are in nothing less than a fight to save the internet. Twelve years ago, spammers discovered Usenet and flooded it with spam until it was useless to regular users. Usenet was effectively destroyed by the spammers.

Having stripped Usenet to the bones, the locusts spammers have moved on to email. While not dead yet, email is clearly being destroyed as well. Every week I hear more and more stories of people who are abandoning email because the spammers have made it useless. The spammers themselves have seen this coming and have already moved on to blog comment spam, message board spam, and phone spam.

We are now in a situation where spammers have learned that they can cripple or even bring down spam-fighting organizations by filing frivolous lawsuits or launching DOS attacks. Witness what happened to MAPS, Blue Security, and Osirusoft.

As long as the courts — especially U.S. courts — give spammers free rein to abuse the legal system without repercussions, the situation will continue.

What needs to happen, and soon, is for the ISPs to start giving some real support to the volunteer anti-spam activists on whom they depend. The courts need to start holding spammers accountable for the frivolous lawsuits they file. The legal system needs to pass some anti-spam laws with real teeth (hint: use European anti-spam laws as a model.) Spam-friendly ISPs need to be held accountable along with the spammers they harbor.

Some years ago, anti-spam activists declared a moratorium on their scanceling activities which were keeping Usenet functional. For one week, no spam was cancelled. Not surprisingly, Usenet was immediately brought to its knees by spam. Many servers crashed outright under the load.

If the spammers succeed in shutting down the anti-spam organizations of the internet, we can expect to see email collapse in a similar way, but this time it won't be for just a week.

Further reading

Spamhaus legal answers

Ars Technica: Court likely to order ICANN to suspend Spamhaus' domain.

Securiteam blog: Article by Gadi Evron and legal analysis by Mathew Prince.

Slashdot: Perspectives on Spamhaus's Dilemma.

Computer World: Illinois court threatens Spamhaus with shutdown.

Section 230 of the Communications Decency Act, USC 47 § 230 (c)(2) seems to cover actions taken in good faith to block objectionable material.

Google Groups search for 60035 "box 1132" group:*.sightings in .sightings returns many examples of e360 spam.

A true Final Ultimate Solution to the Spam Problem?

A common acronym in spam-fighting is FUSSP — Final Ultimate Solution to the Spam Problem. It's used (usually derisively) to describe the latest proposed scheme to end spam once and for all. Usually these schemes are based on false assumptions or have already been tried with no results.

This time — be still, my beating heart — it looks like some researchers at the University of California might really be on to something.

According to the New York Times, researchers have discovered that 95% of drug and herbal remedy credit card transactions are handled through just three financial companies in Azerbaijan, Denmark and the West Indies. Presumably, if these companies could be persuaded to stop supporting spammers, then the money supply which drives spam would dry up, and the spammers would be forced to close shop.

The UC paper is available here (pdf).

I've said before that spam exists because ISPs tolerate it. This seems to hold true for financial institutions as well. If the financial institutions stopped abetting spammers, the theory goes, then spam would be significantly curtailed.

Of course, I don't have any illusions that this is the final solution to the spam problem. There will always be spam as the spammers find ways around the shut-down of their credit card processing suppliers. But as the shut-downs of major botnet command-and-contol centers in the past have shown, you can fight spam, if you're just willing to do it.

Help fight a spammer SLAPP Suit — donate to defense fund

Spam-fighter David Ritz needs your help.

In previous editions of the Spam Diaries I've told the tale of a SLAPP lawsuit brought against me by spammer Jerry Reynolds.

In a nutshell, Reynolds sued me for defamation over his entry in my anti-spam website. The purpose of this lawsuit, obviously, was to suppress information about his prior spamming activities, and to extract revenge against an anti-spammer who had caused him trouble in the past. For more information about this lawsuit, see my entries About the lawsuits and SLAPP Lawsuits by Jerry Reynolds.

One issue which I've only brushed on is another lawsuit filed by Reynolds, against anti-spammer David Ritz. David is a spam-fighter of long standing, and one of the most meticulous I have ever met. If you ever need hard data on a spammer, contact David. (Just be prepared to wade through megabytes of evidence.) David has apparently been more of a thorn in Reynolds' hide than I have, so Reynolds is pursuing this case with a vengeance.

The case has been going on for more than a year, with Reynolds and his lawyer attacking viciously and repeatedly. David has been repeatedly deposed. His computers have been repeatedly subpoenaed. At his lawyer's request, we've only communicated to each other through our lawyers, so I'm not privy to everything that happened since the lawsuit against me was dismissed, but I do know that his expenses have been astronomical.

SLAPP lawsuits by spammers against anti-spammers are nothing new. Spamhaus has been sued twice. MAPS has been sued multiple times. Numerous other spam-fighters have also been sued. One of the differences here is that David is not an organization with resources or an individual with means. Unlike Spamhaus, he has no pro-bono lawyer. Frankly, I'm surprised he's survived this long.

The actual trial comes up very soon, and so I expect his expenses to increase vastly over the next few weeks.

The purpose of this entry is to ask that people give as generously as they can to David's defense fund.

Checks may be mailed to

David Ritz
c/o Debra S. Koenig
Godfrey and Kahn, S.C.
780 N Water Street
Milwaukee WI 53202

I have also created a web page where you may make donations by Paypal or credit card. This is more convenient, but a check directly to his lawyer's office will get there quicker.

Just for fun, I've created an added incentive: those who donates $500 or more will receive a bound copy of my Encyclopedia of Spam. The cost of producing this will be part of my donation to David's defense fund. This book is the source of this blog's logo.

Please give as much as you can.

Waledac botnet goes down

Another triumph in the "yes, you can fight spam" category: Kaspersky lab's Thread Post newsletter is reporting that the Waledac botnet has been knocked nearly completely off line and is sending almost zero spam.

I briefly mentioned the Waledac botnet in an earlier post in which I reported that Microsoft had significantly damaged the botnet's command-and-control servers via court order.

More details can be found on Microsoft's security blog in the article What we know (and learned) from the Waledac takedown.

Pitylak's tips for stopping spam

In an attempt to prove to the world that he really has turned a new leaf, Ryan Pitylak has published his tips on stopping spam. You can read them at Ann Arbor News. His tips basicly amount to 'hide your email address' and 'use the unsubscribe link'.

Ryan, are you reading this? How about this idea instead? Why not take all the information you have about your former partners in crime and give it to the authorities. Now that would help fight spam.