NY AG Sues MonsterHut Over Marketing Spam 235
Ian Hill writes: "This BBC article tells how NY State Attorney Elliot Spitzer has sued marketing firm MonsterHut.com over "millions" of unsolicited e-mails. He claims MonsterHut.com falsely told its clients that e-mails sent on their behalf were sent to addresses who registered themselves as interested parties. Also at question is how exactly these addresses were collected." eviljim adds a link to a press release from New York's Attorney General and a reminder of how MonsterHut was disconnected from their ISP.
Good - Make SPAM cost the spammer (Score:5, Interesting)
I do worry though about legal remedies just moving the problem to where the laws don't exist.
.
Re:Good - Make SPAM cost the spammer (Score:3, Insightful)
So do I. Unfortunately I don't think that the proper solution, vigilantism (stringing up spammers, beating and killing them brutally) will be smiled upon by the courts.
Not quite (Score:2)
Jurisdiction issues (Score:3, Interesting)
--CTH
Re:Good - Make SPAM cost the spammer (Score:2)
Re:Good - Make SPAM cost the spammer (Score:5, Interesting)
I have no problem with the infomercials, because they don't pretend to be anything else, and they don't fill up my mailbox, and they don't cost me more than the cost the person who paid to put them on the TV station.
Besides, if you actually sit up at 5AM watching one of those things, then you obviously don't have anything better to do, so they're providing you a service .. (at the very least, they're helping to pay the TV station for the costs of broadcasting 'buffy'.)
Re:Good - Make SPAM cost the spammer (Score:3, Insightful)
Re:Good - Make SPAM cost the spammer (Score:3, Insightful)
On the other hand, it's not spam if you willingly opted in to some 'free service for ads' scheme. Similarly, the ads on /. aren't spam because I willfully came to the site, and they just happen to be here (and well paid-for, one would hope).
Re:Good - Make SPAM cost the spammer (Score:2)
I've lost important e-mails because they got mixed up in a big mess of junk e-mail. I want to personally beat to death the sender of every junk e-mail I've received...well, not beat them to death. Just beat them until they're barely conscious then set them on fire.
Re:Good - Make SPAM cost the spammer (Score:5, Interesting)
Re:Good - Make SPAM cost the spammer (Score:2)
STATE LAWSUIT SEEKS TO END SPAM EMAILS SENT BY NIA (Score:3, Informative)
Spitzer Says Company Sent More than 500 Million Unsolicited Messages to Consumers
Attorney General Eliot Spitzer today filed a lawsuit against a Niagara Falls-based "spammer" that sent hundreds of millions of emails to consumers whom it falsely claimed had requested the emails.
"Every day New Yorkers are being inundated with unsolicited commercial emails, or spam," Spitzer said. "Some of the spam is a vehicle for fraud, some of the spam is inherently fraudulent, and much of it constitutes a real annoyance for email user. This lawsuit is the next battle in our continuing fight against online fraud, and an attempt to help consumers maintain control of their email in-boxes."
MonsterHut, Inc., its Chief Executive Officer Todd Pelow and its Chief Technical Officer Gary Hartl, are accused of fraudulently advertising and representing the company's email marketing service as "permission based" or "opt-in," meaning that every consumer to whom they send commercial email has explicitly asked to receive it. In fact, the suit alleges, the company's email lists are only partly "opt-in," and include many consumers who never asked to receive email from the company. The suit also alleges that this false representation of MonsterHut's business practices enabled the company to profit through the deception its Internet access provider, its own paid advertisers, and consumers at large.
The suit alleges that since March 2001, MonsterHut has flooded consumers' email in-boxes with more than 500 million commercial emails, advertising a variety of goods and services. At the same time, negative consumer response to MonsterHut's spam has been overwhelming. More than 750,000 consumers have requested to be removed from MonsterHut's mailing lists, and tens of thousands have complained to MonsterHut's internet access provider, PaeTec Communications, Inc., of Rochester.
Earlier this month, PaeTec cut off MonsterHut from its network, after a New York appeals court held that MonsterHut had violated an anti-spamming provision in its contract with PaeTec. However, nothing in that decision prevented MonsterHut from spamming consumers through another internet service provider.
"We are seeking to prevent MonsterHut from continuing its fraudulent, deceptive and illegal practices, not just over PaeTec's network, but over any ISP in New York," Spitzer said.
The Attorney General is seeking a court order to:
- Enjoin MonsterHut, Pelow, and Hartl from falsely representing the nature of their unsolicited commercial email;
- Require MonsterHut, Pelow and Hartl to disclose how it obtained all the consumers' email addresses; and
- Require MonsterHut, Pelow and Hartl to pay civil penalties and court costs for its violations of New York's consumer protection laws.
This case is being handled by Assistant Attorney General Stephen Kline of Attorney General Spitzer's Internet BureauSPAM (Score:2, Insightful)
Incorrect use (Score:2)
Micropayments (Score:5, Interesting)
Hell, running an open relay would rapidly go from moronic to profitable
--
Phil
Re:Micropayments (Score:2)
You're only half right. I would describe this as profitable stupidity - getting paid to be stupid.
The choice is clear and obvious (Score:4, Insightful)
All the logic is there an the anti-junk-fax laws. It just needs to be applied to e-mail. This way it would be much easier to prosecute groups like monsterhut.
Re:The choice is clear and obvious (Score:2)
I'm a minority. I don't mind spam as long as it targets me, personally. I don't mind wading through spam about PC games, or cheap computer components. I do mind emails from Jenna and her sorority sisters telling me how they'll get naked if I click this link.
Re:The choice is clear and obvious (Score:2)
We need another email system. We need a system that uses technical solutions to make spam identifiable, early on in the chain. Systems should not relay spam, period. You're either participating in the transparent email relay system or you're not. Email that goes through shadows should be marked as such. We only need a few of the very big guys to provide, as a choice to their users, the ability to opt into the safe email system.
When I receive email on one of my older accounts, the first thing I do is highlight everything, then pick and choose through the subject headers for what's relevant. Usually I'll find two real emails out of about 30.
Re:The choice is clear and obvious (Score:2, Insightful)
No problem ... just firewall whatever country permits this behaviour. When those countries get the idea that spam is bad and want to send e-mail to the US [slashdot.org], they shut the spammers down and we un-firewall them.
This would crack down the americans spamming through open relays in asia, people who are actually living in other areas to send spam to us. (Do I sound overly xenophobic?)
Re:The choice is clear and obvious (Score:2)
That said, I've hacked my sendmail server. It now analyzes mail as it comes in. In addition to the standard blocking of known spammer IP blocks/domains, my sendmail now looks at the stream coming in when the spammer connects to the mail server. Certain conditions/strings are a dead give-away that the incoming mail is spam.
As soon as my SMTP server decides the incoming message is spam, it hangs up cold. No error message, nothing. Just hangs up. Doesn't matter if it comes from an open relay or dial-up, if certain conditions are true, I know it's spam.
My spam count has gone from 30-40 day down to 3-7 per day.
It's actually gratifying to do a tail -f maillog and watch the spammers try, get hung up on, try again, ad nauseum...
Re:Conditions/Strings? (Score:2)
I've been doing this for just the last week and a half. I log every spam that gets disconnected. So far there have been no false positives. The only annoyance has been that others using my mail server that forward me their spam sometimes get disconnected because I've already added a filter that catches what they are reporting. :)
Re:The choice is clear and obvious (Score:2)
Let them. Costa-Rica was a popular spam-haven until the whole country got black-holed in blocking-lists.
Even China and South Korea are slowly getting a clue. Now if only we [tinw] could mallet some sense into UUNET and Verio...
Re:There is one! (Score:5, Insightful)
Hey, Coward, this is not a speech issue. It's a property rights issue. I don't get upset about junk mail in my postal mailbox; I don't have to pay for it. The sender pays the postage to have it delivered to me. I just carry it to my trash.
Spam, on the other hand, is often times paid for by the recipient. If you want to play First Amendment with me, I'll play Fifth Amendment with you:
Since you say that Spam is the sender's First Amendment right, it appears that delivery of said spam is "public use," and can't be paid for by the recipient because there's no just compensation. Spammers can't take my money (private property) to deliver your message (public use) without paying me (just compensation) in return for paying for your message's transmittal.
By the same token, you can't use the Freedom of the Press clause-- for the same reason. I can't be forced to pay (private property) for the publication (reception) of spam (public use) without paying me (just compensation).
If they want to pay me to receive their messages, that would be constitutional. As it stands, sending people unsolicited messages that they must pay for is not only not protected speech, but unconstitutional.
Read more about it [nara.gov]
Re:There is one! (Score:4, Informative)
Amen.
I'll see your Fifth Amendment response, and, I'll raise you a Supreme Court ruling.
A man's home - and his email box - is his castle. Any spammer invoking the First Amendment is full of it.
Attorney General Spitzer, YOU ROCK.
Re:There is one! (Score:4, Interesting)
Ownership does not always mean absolute dominion. The more an owner, for his advantage, opens up his property for use by the public in general, the more do his rights become circumscribed by the statutory and constitutional rights of those who use it.
Not that I think that spam is good, rather the argument that "My mail server is mine, thus spam is illegal" does not follow.
- Justice Black, U.S. Supreme Court, Marsh v. State of Ala., 326 U.S. 501 (1946)
Re:There is one! (Score:3, Interesting)
Please, leave my infrastructure intact. I'd rather that I get the mail and filter it than have random messages dropped because I couldn't let the public at large email me.
Re:There is one! (Score:2, Insightful)
Re:There is one! (Score:2)
To take your point a little further. Why can I not bill for time spent disposing of junk mail? (in addition, materials garbage bags, etc.) What about electricity used to power the doorbell when a solicitor comes?
Spam sucks. However, I am not sure how much resources you are deprived of compared to other previously accepted solicitation norms.
Re:There is one! (Score:2)
There's probably been a few other cases establishing email servers as private property and that's there's no such thing as "the right to email".
The latest blocklists (SPEWS) go after the spamhausen ISP's IP-blocks as well as the spammer's IPs. It's a shame to block non-spammers as well, but they are supporting spam-friendly companies with their money. Hitting the ISPs in the pocket book is the best solution yet, because pin-point IP blocks just didn't work.
Re:There is one! (Score:4, Informative)
In the US, your mailbox doesn't actually belong to you - it belongs to the US Post Office. They allow you to take mail out of it.
I don't like junk mail, but someone's paying the US Post Office to deliver the snail junkmail to mailboxes which are the US Post Office's property. (To be absolutely technical - I think it's something like "you may purchase and own the physical container on the fencepost near the driveway, but the USPS still owns the space within it.")
> (in addition, materials garbage bags, etc.) What about electricity used to power the doorbell when a solicitor comes?
OK, fair enough :)
The (non-property-rights) issue with spam is the one of scale -- junk mail costs money for the sender to deliver. Door-to-door solicitors are throttled by the time/effort that it takes to walk from door to door. Even telemarketers are rate-limited by the number of drones they can have behind the predictive dialers. (Which is we've passed laws to try and combat the use of prerecorded telephone messages. But even these are rate-limited by the time it takes the recording to play back into the victim's voicemail.)
Spam, regrettably, has no such bottleneck. Even if you don't agree that it's theft of the recipient's mailbox, most of it comes through open proxies and open relays -- which clearly qualifies as stealing service from the victimized hosts.
Whether they're stealing very small amounts from millions of victims (the recipients) or larger amounts from a few victims (the bandwidth stolen from unauthorized abuse of intermediate open relays and open proxies) - spammers are thieves.
Re:There is one! (Score:3, Informative)
You have the right to speak; you don't have the right to force people to listen.
Spam wastes my time. If I pay by bandwidth, it wastes my money. At the very least, I have the right to refuse it; at best, I have the right to restitution for damages.
Re:There is one! (Score:2)
When... (Score:2)
Courts and Technical Solutions (Score:2, Insightful)
Source-based filtering work best when the sources are concentrated and not moving (like when Sanford Wallace was making most of the noise.) This still works a little, and is the premise that all the various RBLs and DNS-BLs are based upon. Content-based filtering works only when the content of the spam is either identical for a large number of victims over time (which is how razor works) or contains patterns that are very unlikely to appear in legitimate email. (Tools like spamassassin work well against these.) If these technical measures against (obvious) spams were effective and universially applied, it would cut down on the volume of spam, but the spammers would get more subtle, and start sending spam that is very hard to detect.
Since most spammers do it only once (but there are a lot of them) it would likely help to educate the public that the spamware-salesmen are essentially con-artists. If it were illegal to send spam, this would be a lot easier. Legal measures alone would likely be unenforcable, because of the sheer numbers of spammers, and the fact that its easier for them to get new accounts and other services than it is to track them down. If I my offer an analogy, this is like people burguling my house. I can stop most of them by putting locks on my front door. For those that are determined enough to defeat those locks, the police will will stop them by sending lots of men and women with guns and handcuffs. It also helps if parents and schools teach their children that it's not right to steal.
Re:The choice is clear and obvious (Score:2)
Ahh, but what's the point in sending spam if they don't give you a "payload" in the spam of some way to contact them? (email, web-page, phone number, snail mail address, etc) Granted spammers use all sorts of tricks like open relays, proxies, obfuscated URLs, fake headers, etc, but they can't hide forever. Google searches of net.admin.net-abuse.email & sightings can be helpful if someone has already tracked down the spammer.
Criminal Perjury Charges (Score:5, Interesting)
On a sidenote (with regard to the quest for the email address source), it's fairly common knowledge (enough so that Paetec mentioned it somewhere on litigation.paetec.net [paetec.net] back when they were soliciting affidavits from spammed parties) that a number of the addresses used came from WHOIS records.
Paetec made the mistake... (Score:4, Informative)
Paetec made the mistake of agreeing to contract terms that specified that if 2% (I think that was the figure) of the addresses were found to be non-opt-in, that this would be an acceptable margin of error. Presumably MonsterHut would have removed them from the list if asked. Even in the worst case of assuming that every complaint was one of those non-opt-in addresses, the complaints would have had to reach the level of 2% for Paetec to disconnect them under terms of the contact. It's that contact that allowed MonsterHut to get the injunction. MonsterHut didn't need to say that 100% were opt-in ... it only needed to say that 98% were opt-in, and Paetec didn't have enough numbers to prove that more than 2% were genuinely non-opt-in, at least not initially.
Paetec made some legal blunders. The rest of us can learn from their mistakes. I'll give Paetec the benefit of the doubt for being fooled in this case. A future company will not get that from me.
One step an ISP can do (if they didn't stupidly sign away any rights to do this) is to put the spammer on static IP and set up reverse DNS to name them with the spammer's domain name. Then I can block the spammer without blocking the ISP, regardless of the stupidity of the ISP's lawyers. And this is my common practice ... I block just the spammer if they are in reverse DNS identified static addresses. And I block them by their domain name, so if they move, even to another ISP, they are still blocked. They have to change domain name to evade this (and I'm sure many have).
Also, I do all my anti-spam blocking at the server during the SMTP session. I don't want their spam in my servers, and I don't want rejection notices to sit undelivered for days, either. By stopping spam before the mail is delivered, it doesn't get queued and the sending server has to deal with the rejection (but there is still a rejection in the cases of legitimate mail getting caught so the sender at least knows something happened, and can look for a way around).
Monster Hut (Score:3, Funny)
Cell phone spamming (Score:5, Interesting)
Wouldn't be too hard to take the ball and run with this one. Get on the message boards and put your number in your sig. Too bad I don't have the time or resources to do it.
Re:Cell phone spamming (Score:5, Interesting)
Re:Cell phone spamming (Score:2)
Of course, you'd have to lock down the full text of the email so that you could get the headers to locate the spammers..
TO do that, you'd have to supoena the Phone company .. If you could figure out if the spammers were all the same people, you might be able to get the phone company as a third party (they have LOTS of money to suck in..)
Add in punitive damages, and you've got a real nice class-action suit.
Re:Cell phone spamming (Score:2)
Nope. (Score:3, Informative)
We need more of this (Score:2, Interesting)
Re:We need more of this (Score:3, Insightful)
If you didn't reply the first 100 times, maybe you'll reply on the 101st. Remember, a spammer might have paid good money ($0.000001) for your email address and when you don't reply he's forced to eat the loss, damn it. And when you're running a prestigious nonaccredited university, every microdollar counts. So it's quite cost effective to hammer you with the same spam using a hundred different subject lines because someday you might go crazy and decide you do need a larger penis (or that you have a penis to enlarge at all), which would give the poor guy a return on his investment.
Why 5 duplicates? Most of the real money in spam comes from selling your list of addresses, because that's the only thing a spammer has to sell. (It's the only thing he pays for besides the throwaway dialup accounts, cable modems, address harvesting software, and sex, and none of those has a comparable resale value.) A spammer typically runs around buying or stealing all the lists he can find from other spammers, so he can compile them into one big list and resell it to other spammers. He obviously can't be bothered to remove duplicates, because 1. that would require him to use his own computing resources, which is forbidden in the spam business, 2. the guy he bought his lists from didn't bother to remove the duplicates, so why should he remove them from the compiled list he's selling? and 3. when you remove duplicates the list gets shorter and commands a smaller price, so what's the motive in doing it anyway? To avoid pissing off the recipients? Ha, ha, ha, ha. A list of 1,000,000 email addresses in which each address is duplicated 5 times will sell just as easily as a list of 1,000,000 addresses with no duplicates. In fact the difference between "200,000 email addresses!" and "1,000,000 email addresses!" is usually four Control-Vs.
Or why would I answer if they use a completly misleading subject line so that it gets through my filters?
Why would you answer if they used a subject line that doesn't get through your filters?
Re:We need more of this (Score:2)
A lot of the small-timers give it up pretty quick after they catch a clue-stick upside the head. (There's no end to the suckers who believe that a "marketing" company has real honest "double opt-in" mailing lists. Endless sob-stories on NANAE: "But they promised it was opt-in!") Others linger for a while, jumping from ISP to ISP. And then there's some hardened spammers who have been at since the mid '90's.
Block lists that block ISP ranges are now putting pressure on ISPs to chose between spammers and legitimate customers. Regretable, but it's the only thing that seems to work with clueless / unresponsive / spam-friendly ISPs. (Especially the ones that will hop the spammers around to get past lesser block-lists.)
Gee - Using EXISTING laws! (Score:4, Insightful)
Re:Gee - Using EXISTING laws! (Score:2, Insightful)
SPAM and internet scams operate on a different scale than anything before. I probably get no less than 150-200 SPAM emails a day. Assuming they all from different senders, and are all fraudulent (which I realize is quite an assumption) let's figure out just how much time/money it would take to prosecute them all. Let's say for arguments sake that it takes 15-20 hours to collect information, and find the person to prosecute in the first place. Then let's suppose there's another 200 man hours involved in bringing this to trial. Including the judge, attorneys, etc this is probably a conservative estimate. Now let's suppose each of the people along the way (two attorneys, judge, technician to collect evidence) are making $40,000 each of taxpayer money, again that's probably conservative. Using the above estimate of 220 man hours per spam, that gives us a cost of $4230. Seems to me that's probably on the low side. Multiply this by the 200 messages a day I'm getting, and WOW $846,153 to prosecute the senders of one days worth of spam for one user. That's a lot of money.
All the laws in the world won't help with this problem. So long as the system is designed to allow the amount of spam that's out there, there's not much laws can do to change it. We need to either change the system so it costs the senders to spread around thousands upon thousands of emails, or find some other way to penalize without involving the already overburdened, underfunded, bureaucratic legal system.
Re:Gee - Using EXISTING laws! (Score:2)
I regularly post to usenet groups and mailing lists with my real address and conduct business online with it as well.
At most, I've received 20 spams in one day. The average is 3-6. 90% of these are caught by filters.
Re:Gee - Using EXISTING laws! (Score:2)
Bork!
Simply Shocked (Score:3, Funny)
I am "simply shocked" that a company would tell such lies to it's customers.
Thank God that we don't know of any other companies that would do something like that.
Re:Simply Shocked (Score:2, Funny)
Tricky... (Score:2)
Topics lately that have passed my spam filters, "Your Bill", My Name correctly(most spam dont use names, just email addresses), Actual products that I use, (someone must of sold my email address), Mailing list type headers (vnc/linux kernel/etc).
Funny thing, some mailing lists are tagged as spam, like IGN computer news, which I had to tag as good. Spam takes way more of my time than it should. I know for sure, I havnt opt'ed in for anything, and "Opt-Out" is a fucking joke.
Re:Tricky... (Score:2)
I figure the spammers can clean the trash out of their OWN mailserver's queue, thank you very much.
The way I DO get spammed is from postings to mailing lists and groups on Yahoo, where I don't have any control over the information disclosed in a message's headers. I've stopped doing that. Additionally, I read my mail with KMail which allows me to "bounce" messages from spammers. That usually tells them my address is invalid, even though it's not.
Re:Tricky... (Score:2)
This message was created automatically by mail delivery software (Exim).
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
pppp@127.0.0.1
unrouteable mail domain "127.0.0.1"
So, if it's not a legal address, why do so many think that it is?
Very curious.
Re:Tricky... (Score:2)
So the mailserver tries to send it to itself, realises it's not supposed to recive addresses from there and spits back an error.
If you have control of a nameserver you can make a domain resolve that way and then the spammers can't detect it as easilly.(potentially more fun)
Re:Tricky... (Score:2)
OK, another test. A mail to slashdot-1@pdrap.org works just fine. (I've blocked that address because spammers found it a while ago). But, a mail to slashdot-1@65.188.39.1 does NOT work.
So, your explanation doesn't fit the observed facts.
What am I missing?
Re:Tricky... (Score:2)
Re:Tricky... (Score:2)
Re:Tricky... (Score:2)
Re:Tricky... (Score:2)
Besides, chances are you don't want to mislead people as to what your reply address is if you're sending them email
Unless, of course, you're a spammer!
Re:Tricky... (Score:2)
Re:Tricky... (Score:2)
I've had my email address for a while, but what I do is, once in a while, I go on a hunt-and-kill binge.
I've stopped trying to track down where spams are coming from. I just follow the links to the web sites that they link to and contact the ISP to have them shut down. After each hunt-and-kill binge, my spam seems to quiet down quite nicely.
Spam sources are a bitch to track down, and a dime-a-dozen. On the other hand, spammers need consumers to be able to contact them, and web sites take some work to set up. If you shut down their web sites, it actually costs them money.
Re:Tricky... (Score:2)
I think Ill write a spam tracker, some kind of spam database, track the headers, do an ISP search, state search, and find a nice pattern. Wonder if any of the larger spam black lists do this already. A hit list of spammers ISP.
how to stop spam: (Score:2, Funny)
Instead of calling it your 'inbox', it's now your 'american spirit'.
Those dirty emails you send to your wife are now 'vital communications of the heart'.
Your mom nagging you to visit her more often are 'sincere messages from the home front'.
Once we make spam a terrorist act only terrorists will send spam! U-S-A! U-S-A!
Just a thought... (Score:2)
Watch that slope (it can get awful slippery) (Score:3, Interesting)
But here is the HOWEVER.
With technology regulation a) not particularly well defined on the books, and b) almost always implemented the *wrong* way (DCMA?), I have little doubt that many legitmate newsletters and mailing lists will get hit by Mr. Spitzer's shrapnel. There are plenty of Attorneys General out there who are not quite so intelligent as sheep (let alone, Mr. Spitzer), and will follow New York's example to the detriment of legitimate mailers.
Damn. Another message for teen sex in my Inbox. Heck, maybe it's worth it....
-FC
Yes! (Score:2)
Thank god for Elliot (Score:5, Interesting)
First it was unsoliticited phone calls (we were one of the first states to set up a no-call list). Now I recieve maybe 1 unsoliticited call every 2-3 months instead of 1 or 2 a day (and at dinner time.... arrrrgggg).
Then it was dissent on the microsoft case. In all likelyhood, New York State served as a keystone for the 9 dissident states.
Now we've got Spitzer battling the evil spam demons. My guess is that once again, Spitzer will come out on top.
Spitzer is a definately a defendant of consumer rights and privacy and has been unwavering in his cause.
my
We Can't Stop Spam, so Stop Fraud (Score:3, Insightful)
The problem is fraud. (1) Spammers forge return-addresses and lie in their subjects to trick you. This makes it hard to weed out unwanted mail. (2) Practically all spam comes from fraudsters. Spam is so despised as a marketing tactic that it cannot be used (openly) regularly by legitimate businesses without them getting a lot of flak.
I hate spam. It drives me crazy. But I believe we will never fully get rid of it, because it makes money. And there may truly be compelling free speech reasons that keep us from banning it (I'm not decided on this point).
But I think three steps would take most of the pain out of spam for me.
- Spammers who are criminals (stock-pumpers, penis-mightiers) get arrested and deterred/reformed. The NY AG move is a much-needed start.
- Spam must be given a proper subject like "ADV:", and need a legitimate return address. Violators are subject to large fines and jail.
- Spammers need to pay for all their bounced mail. Not sure how to enforce this, but it would make me feel better.
Once these things are true, maybe spam will reach the same annoyance level as junk mail in real life: annoying, but not obscene.Diminishing spam for me (Score:2)
2002-05-01 09:37:21 recipients refused from [212.90.15.164] (RBL relays.ordb.org)
2002-05-05 07:49:48 recipients refused from [210.76.113.46] (RBL relays.ordb.org)
2002-05-07 00:18:46 recipients refused from cis-ns.careinfo.co.jp [210.226.191.114] (RBL relays.ordb.org)
2002-05-09 02:49:48 recipients refused from [200.24.95.174] (RBL relays.ordb.org)
2002-05-13 13:14:06 refused relay (host) to from H=nat170.63.mpoweredpc.net (none) [142.177.170.63]
2002-05-15 18:06:36 recipients refused from [211.218.38.20] (RBL relays.ordb.org)
2002-05-15 23:36:06 recipients refused from w045.z208037064.nyc-ny.dsl.cnc.net [208.37.64.45] (RBL relays.osirusoft.com)
2002-05-15 23:58:10 recipients refused from [211.174.179.8] (RBL relays.ordb.org)
2002-05-16 20:33:15 recipients refused from [202.164.96.4] (firewall-user) (RBL relays.ordb.org)
2002-05-17 04:01:57 recipients refused from [202.164.96.4] (firewall-user) (RBL relays.ordb.org)
2002-05-18 19:16:22 recipients refused from [210.105.80.65] (RBL relays.osirusoft.com)
2002-05-19 11:36:51 recipients refused from [202.164.96.4] (firewall-user) (RBL relays.ordb.org)
2002-05-21 23:41:55 recipients refused from [202.164.96.4] (RBL relays.ordb.org)
2002-05-24 06:53:23 connection from outmta016.topica.com [64.125.140.225] refused
2002-05-24 06:53:54 connection from outmta016.topica.com [64.125.140.225] refused
2002-05-24 07:41:45 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 08:33:05 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 09:35:23 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 10:46:02 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 12:17:27 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 14:19:49 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 16:23:14 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 19:01:45 connection from bso002.topica.com [64.125.140.241] refused
2002-05-24 21:31:16 connection from bso002.topica.com [64.125.140.241] refused
2002-05-25 00:07:19 connection from bso002.topica.com [64.125.140.241] refused
2002-05-25 05:29:37 recipients refused from www.shinohara.com [209.153.61.10] (RBL relays.ordb.org)
2002-05-25 16:22:30 recipients refused from [203.199.213.3] (RBL relays.osirusoft.com)
2002-05-28 04:37:49 recipients refused from h-64-105-76-95.nycmny83.covad.net [64.105.76.95] (RBL relays.ordb.org)
2002-05-29 08:22:41 recipients refused from [211.102.2.131] (RBL relays.ordb.org)
So you can see I'm rejecting mail per relays.osirusoft.com and relays.ordb.org. My LART list is pretty big, too. But that's just for a small mail server.
If you apply similar rules to a multi-hundred or multi-thousand user system, you can really cut down on tons of UCE. Combine it with spamassassin and UCE will almost never get in your inbox.
Spamhaus.org's collection on MonsterHut (Score:3, Informative)
Spamhaus.org records about MonsterHut [spamhaus.org]
It includes such gems as
MonsterHut's PR [spamhaus.org]
and
Whine: MonsterHut Letter to Spam Clients [spamhaus.org]
(scroll down - the header index is identical for these links, but the material below is different)
Definitely worth looking over, for a profile of a spammer.
Sig: What Happened To The Censorware Project (censorware.org) [sethf.com]
Re:Spamhaus.org's collection on MonsterHut (Score:2)
From the PR link you posted (emphasis mine):
So, given the double negative, does that mean that the graphics arts department at MonsterHut is surpassed by all competitors? heh.
No more laws please (Score:3, Interesting)
If we want the government to stop trying to creake things like mandatory age checks before accessing adult material, then we need to stand up and tell them not to create spam laws either.
It is a problem that can be solved technically. We should strive to find better technical solutions instead of finding ways to sue them.
Re:No more laws please (Score:2, Redundant)
The answer is obviously no.
There's nothing about creating anti-spam laws. It's about prosecuting someone under existing fraud and consumer protection laws.
You want technical solutions? Sure, whatever. They don't work. They'll never work. There will always be open relays out there to abuse, and even if you block them the bandwidth is being consumed. So you haven't solved the problem - you've just masked it.
The only hope is to use existing, rock-solid laws such as those stated above, to prosecute spammers into oblivion. If successful, MonsterHut is facing several billion dollars in fines, and I seriously doubt that the CEO or CTO will be able to hide behind the corporate veil on this one. Push them out of the US and other leading countries and they'll wind up with no bandwidth to do this kind of thing. Then your technical solutions can come to bear - countries without laws? Blackhole them. Then they'll pass laws and throw out the spammers, or relegate themselves to the 19th century.
Government is supposed to look out for it's citizens. This is a fine example of it doing exactly that instead of protecting the corporate entity.
Re:No more laws please (Score:2)
Essentially, I'm safe if I advertise my services as:
And the "privacy policy" says nothing about getting off a list or stopping the flow of mail.
...at least according to what was in the article. Doesn't look like there's anything else that they can prosecute.
Re:No more laws please (Score:2)
I think that this is very good. and it sets a good precident. We don't need more laws to control the garbage that goes on on the internet. We simply need more inventive ways of enforcing the laws that already exist.
Monsterhut should not only be sued for misrepresenting customer consent to recieve the emails -- they should also be sued for misrepresenting where their email came from. Fraudulent headers are just that -- fraudulent. They should be attacked in the same lawsuit, and also prohibited.
Re:But it COULD be fixed. (Score:2)
Meanwhile, the cost of this is billions of dollars a year. Lots of
We have to figure out how to fix this, tomorrow, or we have to ask the government to do it. It has to be fixed. Technical solutions may work, but may doesn't mean jack--they're not working now, and that's all I care about.
If you (the collective you, the people who say "we need a technical solution") can't fix it, STFU. I'm not talking about filtering or RBL lists, I'm talking about putting the spammers out of business. If they're sending spam, your job is not done. And if you can't stop them, again, STFU and let the government take care of it. It has to be done; the costs are too high, and it really gets me worked up.
Until I can post my e-mail address on slashdot without obfuscation and without fear of harvesting, until I can telnet into my POP server and read my mail without getting pissed off, until the primary meaning of Spam is once again spiced ham, you "we need a technical solution" people may not sleep. Billions of $$$ a year.
Re:No more laws please (Score:2)
That is what the system is supposed to provide. A way for people to get governance that they want, and vice versa.
Re:No more laws please (Score:2)
Comment removed (Score:3, Interesting)
Why not whitelists? (Score:2, Insightful)
I realize that some people do have a different email usage pattern and do get lots of mail from new senders, but then you could just use an "ask for confirmation" style whitelist filter.
Is there some reason why whitelists aren't more popular (aside from the fact that it's not the default configuration of Outlook [Express])?
Re:Why not whitelists? (Score:2)
Aside from the reasons mentioned from the above reply, you can also get email from unknown addresses if you're applying for a job. Finding a job is (apparently) difficult enough these days without possibly bouncing email messages from a potential employer.
Because... (Score:2, Insightful)
If a whitelist is the solution, you don't understand the problem.
A whitelist is pretty much like "bolting the barn door after the horses have eaten your children." You're basically just closing your eyes and saying "I don't see it, so therefore it doesn't hurt me."
Spam has two problems, and the concept of a whitelist (or email client "spam filter") only covers one: the nuisance factor (it's a pain in the ass to wade through all this spam.)
The second, much worse, problem is that spam costs the recipient money. Bandwidth isn't free - it costs money.. even if you don't directly pay for bandwidth, your ISP does, so it costs them money, which they charge to you (even if you don't see it broken down in your monthly bill.)
Any client-based anti-spam "solution" (such as your whitelist) is ignoring this: the bandwidth has already been consumed by the spam, so it's already been spent. Rejecting the email AFTER it's been delivered to your server only means that you don't see it - it doesn't mean that you're not paying for it, and THAT is the biggest problem with spam - you're paying for something you don't want.
A nice change in direction (Score:2)
It's about time the courts were used, en masse, to protect people (us) from the fradulant actions of business (monsterhut and others).
In a free market, business is supposed to be at the mercy of the consumer. We keep the government around to pass and enforce laws when that does'nt happen. It really does make me feel good to see the NY AG doing it's job.
---
I want their servers..... (Score:2, Funny)
Spam Bad- Fake Addresses worse (Score:5, Insightful)
No, this current approach is a losing battle. What we must have is transparency. The Spammer cannot be allowed to use fake email addresses. I have complained about commercial emails with fake addressee, and the providers refuse to do anything. There must be an opt-out link or email address that is in the same domain as the from and return address. These address must be in the owner domain, and not Yahoo, Hotmail, or whatever free service they use for one time addresses. The subject line must clearly identify the company being advertised. If the email is to a website, the website must have an email link, and, if it is a DBA, must have a link to the corporation or person.
These guidelines will create a proper and honorable two-way communication. There are companies like (I think) Virtual Holdings that cowardly hide behind fake addresses and do not even put a real address on their domain registration. They keep their costs down by hiding behind fraudulent websites that do not have a single method of communicating with the owner. It is the highest form of arrogance that they think they have the right to spam us, but we don't have the right to spam them.
I know it has been said before, but let me say it again. Get a free email account. When you get a spam, especially with a fake email, look up the registration for the websites advertised. Look up the registration for the DNS providers. Send an email to every address you can find stated how cowardly and dishonorable using fake email addresses is. Let them know we know they are vermin. You do not even have to include your own information, as you are complaining about bad netiquette, not Spam.
Re:Spam Bad- Fake Addresses worse (Score:2)
Treat them as such.
I've never supported or encouraged attacking(DoS) people like this, but dammit, someone needs to grab them by the balls and HURT them. figure out a way to run up THEIR bills. track theirs asses down and PROSECUTE THEM. Make it cost too much for them to continue doing what they're doing.
I hope this AG nails monsterhut up by the gonads and not only runs them out of business, but sends the brainchild behind it to jail.
/me deletes another 50 spams out of his account.
bastards.
Now we need to get the California AG a clue (Score:2)
They accept non-spam complaints from a web form, so they know how to do it right. Clearly they're not serious about stopping spam, even though California has a strong anti-spam law, and the courts have ruled that it is valid. There haven't been any high-profile spam cases from the California AG yet.
(There's a legal challenge to the California anti-spam law, but the spammer is losing. The California State Supreme Court recently decided that the California anti-spam law was valid (Ferguson vs. Friendfinder). Friendfinder may still try an appeal to the U.S. Supreme Court. But that has to happen soon, or the decision is final.)
Re:Now we need to get the California AG a clue (Score:2)
Stopping Spam... (Score:2)
First I grabbed a sendmail access database someone else was using as a base to start my anti-spam efforts from. To this I add domains from which I or a coworker received spam from. One spam and it's done. This list contains more than 9000 domains and IP addresses.
Next I added ordb.org as an RBL. This has helped as well but has also exposed some of our clients as having open relays. I find it interesting to get a call insinuating the problem is with my mail server when the user has not even read the error message. (Which, as you may know, tells them to visit ordb.org to find out what the story is) It is frustrating to explain that I am not going to turn off my RBL because their mail server is incorrectly configured.
I've been using the RBL for about 20 hours off and on and the access database for about two days. So far it has dropped 309 messages intended for a mail server with about 20 users on it.
Re:Spamming (Score:2, Insightful)
But with the cost of email spam (the opportunity cost) being orders of magnitude lower, to the point where it's so close to zero per unit, the "social contract", whereby the one doing the soliciting has made an up-front investment, has been violated.
Oh, by the way, deleting spam on your computer is not free. It takes some of your time, and, even if you were to value your time at the minimum wage, your investment is far higher than the spammers.
Re:Spamming (Score:2, Interesting)
And, opting out is easy in your mailbox. Just write "Return to sender" on the unopened message, and put it back in your mailbox. The USPO will charge the sender to return it, and the sender will usually abruptly stop. If you want to get nasty, tape the letter to a brick first
Re:UCE (Score:2, Interesting)
i have a yahoo account, get about 5 spam emails a day, and forward most of them right on to the FTC. not sure if they're actually doing anything, but it makes me feel good
I do the exact same thing, but I think it actually worked. One company had been spamming me for months (I made the mistake of clicking the "remove me" link). Well, one day I started forwarding my spam to the uce@ftc.gov (and spoofed the 'remove me' link to remove uce@ftc.gov
I like to think my tax payer dollars actually did some good.
Re:UCE (Score:2)
Re:Korean Spam (Score:2)
a) man procmailrc, drop it there
b) grep http://www.iana.org/assignments/ipv4-address-spac
I do both. I don't get *Korean* spam any more
Re:Reality Check... (Score:2)
Hmm, maybe he's watched enough slasher films to know that when the bad guy goes down, you keep hitting him. MonsterHut is utterly unrepentent, still assert that their business model is both legal and sound (they actually claim that the court got it wrong), and explicitely intend to start up spamming again as soon as they can slease their way onto another ISP.
While I'm completely ready to agree that Spitzer is probably just showboating and looking for an easy win, I'd be delighted to see a huge fine levied on MonsterHut, regardless of their ability to pay it. The more precedent we get, the better, because every piece of anti-spam case history will make it easier and faster to shut down and sue or fine new spamhausen as they spring up.
The case earlier this month just established that MonsterHut are in the wrong, and let their ISP pull the plug on them. Now we need to assign a suitable punishment, and make sure that we send the message clear and loud: spam is not legitimate, and if you do it, you will pay for it.
Re:Reality Check... (Score:2)
This will do nothing to stop SPAM in your mailbox. How is Spitzer going to go after btamail.net.cn? China is going to tell him to take a long walk off a short pier. This is fine if you want revenge but it will not do anything to reduce the flow of SPAM or cause other people to fear doing it.
Geez, I guess the moderators today are Spitzer Democrats. :)
Give me a f***ing break (Score:2)
That would be pretty outrageous if it weren't a complete and utter fabrication. What actually happened was that he sued several "crisis pregnancy centers" for deceptive advertising. They had ads that implied that they performed pregnancy tests and abortions, when if fact they are essentially in the business of persuading women not to have abortions. Under a consent decree they agreed to change their advertising. They didn't have to pay fines, and they certainly were never forced to provide abortion services.
2:
The idea is to deter future instances.
3:
If they violated current anti-fraud law, why not go after them using the existing statute(s)?
4.
No, but he might get something. If not from the company itself, maybe from the officers of the company personally. Also, see 2.
5.
Obviously this only applies to victims in the state of New York.