Part 1:

HOW UNWANTED EMAIL IS BURYING THE INTERNET

http://www.msnbc.com/news/941040.asp?0cb=-115171549

By Bob Sullivan

MSNBC

Aug. 6 —
About 14 billion spam are sent each day now —
two for every person on the planet, according to one study. Actually, two a day
wouldn’t be so bad. In reality, many Net users say they are drowning in
the

stuff. The unrelenting deluge of unsolicited e-mail makes
finding real e-mail from mom or the boss harder every day. So some are throwing
up their virtual hands, and dropping old, beloved e-mail addresses in a vain
attempt to run away from the bursting dam that is their Internet service
provider. Spam, some say, has gotten so bad that it’s on the verge of
killing e-mail. But if the Internet sky really is falling, why doesn’t
someone do something?

EARLIER THIS
YEAR, a line was crossed. In May, there was more spam than real e-mail flying
around the Internet, according to spam-fighting firm MessageLabs
Inc. And at just about that point, Uncle Sam — specifically, the Federal
Trade Commission — decided to call an old-fashioned town meeting.

Just how
emotional has the spam issue become? At Uncle Sam’s meeting, a fistfight
almost broke out. And that was before a marketing company used the everyone-invited-to-the-table forum as an opportunity to
serve spam fighter Allan Murphy with a subpoena. As anyone in the room would
say, the issue of spam had reached the flash point.

Whatever measures
the e-mail providers have been attempting to plug the dam, they just
aren’t working. Despite all manner of new technology, legislative action,
lawsuits, and outright bodily threats, the spam dam keeps springing leaks. And
many fear the worst is still yet to come.

Pick your
favorite staggering statistic to make the point — both consumers and
corporations are crying out for help. Radicati Group
says spam will cost companies $20.5 billion in 2003 and that by 2007 businesses
will be forking over nearly 10 times that amount of money, or $198 billion, to
battle spam. Jupiter Research says U.S. e-mail users received more than 140
billion pieces of spam in 2001 and an estimated 261 billion pieces in 2002
— an 86 percent increase. AOL says it blocks 2.3 billion spam e-mails
every day. BellSouth says spam will soon add $3 to $5 to each customer’s
monthly bill.

“E-mail is
on the tipping point of becoming more trouble than it’s worth,”
says Ray Everett-Church, chief privacy officer at ePrivacy
Group.

Or is it?

Only a few months
earlier than the FTC forum, the Pew Internet and American Life Project released
its own e-mail and spam study, and it included this startling pronouncement:
Spam isn’t that big a problem. A noisy, wired minority, the report said,
has overexaggerated the spam jam-up. In fact, only 15
percent of workers surveyed say they have to deal with more than 50 e-mails a
day. And nearly three-quarters said “only a little” of their work
e-mail is spam.

NO BIG
DEAL?

Peter S. Fader, a
marketing professor and spam expert at the Wharton School, thinks that far too
much has been made of the spam issue — it’s only a minor annoyance
to most Internet users, he said.

“People
notice spam because of the negative novelty, but it’s not really that big
a part of their life. But if you give people a choice and say,
‘We’ll take the spam away but your e-mail will come in more
slowly,’ people would say, “Give me the spam,’ in a
heartbeat,” he said. “It is just a phase we’re going through.
Two years from now, we’ll look back on the spam thing and laugh.”

Anti-spam advocates,
however, are hardly laughing. But the disconnect over
how bad the problem is might partially explain why spam remains so bad for that
noisy minority — perhaps the sky, and the Internet, really aren’t
falling. Clearly, Everett-Church says, while nearly everyone with a stake in
the issue claims the problem is dire and dramatic, corporate and legislative
actions to resolve it have been slow and considered.

Among large
Internet companies, who regularly cry the loudest about spam costs, action
against spammers has been only incremental.

“The talk
is at variance with the walk,” he said.

WHY
CAN’T WE FIX THE DAM?

The chief
obstacle to solving the spam problem is that there isn’t even yet
consensus on what spam is. Many Net users would simply say it’s any
e-mail they didn’t expect. But plenty of companies feel they can rightly
contact customers with relevant information, and that consumers often want such
a targeted service. To them, only misleading unsolicited e-mail is spam —
that is, e-mail where the true sender is intentionally
obscured, or an e-mail message that makes fraudulent offers.

Legitimate
companies, this world view holds, should get at least one chance to e-mail
people with an ad, the so-called “one bite” approach. And consumers
who opt in for e-mail offers, well, they are fair game.

But while the
debate takes place, the gray area becomes wider, and e-mail marketing companies
with questionable practices have an easy time finding cover.

“The line
between legitimate direct-mail marketing companies and spammers is very
fine,” said Brian Czarny of Message Labs.
“The spammers are good at presenting themselves as direct-marketing
companies.”

The truth is,
while spammers are on the run, they are still winning the race against
corporations and government officials trying to shut them down. For every
spammer put out of business by a lawsuit, probably hundreds of newbies are being trained in secretive “spam
clubs” around the Internet. For every account shut down for illegal
activity, thousands more open up. Technology such as spam filters or
blacklisting techniques can only accomplish so much. In the end, the Internet
still makes things much too easy for the bad guys to hide, too easy for them to
pretend to be an old girlfriend or a co-worker and get you to click on their
e-mail.

PEOPLE DO
BUY, DON’T COMPLAIN

And people do
click. Few will admit it, but several interviews with spammers have revealed
some products really do sell via unsolicited e-mail marketing. On a good day, a
sophisticated spammer might have to send out 10 million e-mails to get 40 or 50
positive responses — but if they are requests for more information on a
new mortgage, the spammers just made $10 for each response, or $400 to $500.
Not a bad day’s work.

In fact,
according to some abuse desk workers, about as many people buy from spam
e-mails as complain about spam e-mails. A 2 million message mailing will
generate 40 or 50 complaints, according to Jim Gregory, a former spam fighter
at now-defunct ISP Slingshot.com. And without complaints, no spammer is ever
shut down.

So for now, the
fight about spam is limited to a relatively narrow cast of characters:

The anti-spam radicals, who
chase after spammers with a quiver full of high-tech tools.

The king spammers, the 200 or so
bulk e-mailers responsible for perhaps 90 percent of the worlds’
spam.

The small-time spammers,
disciples of the king spammers, who are trying to get rich quick via a
modem.

Legitimate marketing companies that really do
believe in the power of e-mail advertising, and are willing to play by the
rules — as soon as someone establishes some.

Big corporations and e-mail providers like
Microsoft and America Online, which can’t help but suffer from
schizophrenia on the spam issue. On the one hand, spammers annoy their
customers and cost them money in bandwidth. On the other hand, none of
them are willing to support legislative action that might someday limit
their ability to make money by e-mailing their customers

Legislators, who see in spam a grass-roots issue
that is starting to resonate with voters, and yet can’t quite figure
out how U.S. laws can effectively regulate an international Internet
issue.

In this special
report, MSNBC.com will chronicle some of the bitter electronic warfare
that’s currently taking place in cyberspace among this cast of
characters. The package will also examine the economics that prime the spam
economy, revealing some beneficiaries of spam that might surprise you. It will
introduce readers to the most important cast of characters in the spam world, a
Top 10 list of sorts, who are ultimately behind most of the unsolicited e-mail
that currently clogs in-boxes. It will uncover some of the games spammers play
and the technology tricks they use to continually punch new holes in the dam.
Finally, it will examine the legislation that’s been designed to plug the
holes in that dam.

fact file

What is spam?

Defining it

• What is spam

• Who sends it?

• What does it cost?

• Legal landscape

Fighting it

• Protect your address

• Diversify

• Read carefully

• Complain

What is spam?

While most
e-mail users think they know spam when they see it, it has proven surprisingly
difficult to define. Some of the most-common definitions being bandied about
in connection with plans to regulate spam are: unsolicited commercial e-mail
(UCE), which excludes unsolicited political messages and possibly outright
fraudulent ones; unsolicited bulk e-mail (UBE); unsolicited commercial bulk
e-mail (UCBE); and unsolicited electronic mail solicitations (UEMS), which
would include even single unsolicited e-mails. Many e-mail marketers prefer a
definition that would require unsolicited messages to be fraudulent,
deceptive or objectionable before they would be considered spam.

Who sends it?

The
spammers who flood your inbox on a daily basis are most likely members of a
relatively small, shadowy group of pros capable of generating hundreds of
millions of e-mails each day and using high-tech evasive tactics to avoid
detection. Together, these big operators send the vast majority of unwanted
e-mail. But they don’t work for free, and a wide variety of small-time
crooks, inventors and even major U.S. companies may ultimately be behind the
campaigns.

What does it cost?

Each year
spam costs each U.S. end user between $30 and $50 and companies $730 in lost
productivity for every employee with e-mail, according to the Anti Spam
Research Group.

Legal landscape

Check the
law in your state and the status of efforts to pass federal legislation at spamlaws.com.

Protect your address

Most spammers
build e-mail lists by harvesting from Web pages and Usenet postings. So avoid
putting your e-mail address on your Web page. If you feel you must, one
helpful trick is to encode your e-mail address using HTML characters rather
than simple text.

Diversify

Use
multiple e-mail addresses, and save one for filling out Web forms and
submitting to companies. That will keep spam out of your primary e-mail.

Read carefully

Read
online forms and software registrations carefully. Be sure to
"opt-out" at every chance, letting companies know you don't want
them sharing your e-mail.

Complain

Not enough
individuals go to the trouble of figuring out who's really behind the spam.
Reading e-mail headers isn't as hard as it sounds -- click here for a good
primer.

Generally,
once you learn the actual sender's domain name, an e-mail to [email-masked]
will do the trick. If it doesn't, here's a link to a site with more
details on finding the right e-mail address for complaints:

Part 2:

IN THE TRENCHES OF THE SPAM WARS

Conflict not for faint-hearted, say e-mailers, anti-spam
activists

http://www.msnbc.com/news/945559.asp?0cb=-215171549

By Mike Brunker

MSNBC

Aug. 7 — Spam is an ever-increasing
annoyance for consumers, but it is far more than that for those serving on the
front lines of the bruising battle over junk e-mail and — some would say
— the future of the Internet. For them, it also is the root of the
hardball legal tactics, hacking, harassment and death threats that are the
hazards of their chosen vocation.

AT THE HEART of
the fight lies a deceptively simple two-part question: How much — if any
— junk e-mail should Internet users have to tolerate in their in-boxes
and how can the flow be controlled?

But with the
rising tide of spam — or unsolicited commercial bulk e-mail, as
it’s more accurately known — the search for a middle ground between
“none” and “as much as we care to send” is growing ever
more difficult.

“An
absolutely guaranteed way to create an irreconcilable conflict is to have two
different groups of people with conflicting memories of the good old
days,” is how John Levine, a board member of the Coalition Against
Unsolicited Commercial E-Mail and operator of the spam-reporting service
abuse.net, sums up the dispute.

STARKLY
DIVERGENT VIEWS

“In this
case, you have the marketers’ good old days, when they could send mail to
anyone they wanted, and the online community’s good old days on Arpanet,
when you couldn’t send any commercial
e-mail,” said Levine, who also is the author of “The Internet for
Dummies.”

The level of
hostility — high to begin with — has escalated with the adoption of
increasingly sophisticated tactics by nefarious spammers, including the use of
hijacked computers to send spam and identity theft to evade detection.

Such actions have
hardened the zero-tolerance attitude of some in the anti-spam community and
fueled the development of what is considered by some to be the online
equivalent of a weapon of mass destruction — the anonymously run SPEWS
(Spam Prevention Early Warning System).

SPEWS lists
swaths of Internet real estate (IP addresses) that are known to be sources of
spam, belong to spam-friendly Internet service providers or host Web sites
advertised in spam. The list is used by some ISPs and network administrators to
block e-mail from would-be spammers before it is sent, which sometimes results
in “inadvertent blocking” of messages from Internet users and ISPs
that have nothing to do with spam.

‘VIGILANTES
OF THE INTERNET’

“The people
who are blacklisting ... are enacting their own revenge against people they
decide on their own are guilty of spamming,” said Mark Felstein, a Florida attorney who is suing the unidentified
operators of SPEWS for allegedly damaging his also unidentified clients.
“They’re the vigilantes of the Internet.”

It is against
this backdrop of hostility and distrust that the virtual combat unfolds each
day, as enemies assume their posts at computers around the world and launch
rapid-strike ad campaigns and real-time counteroffensives. The fighting
intensifies by night, when the roughly 200 big-time spammers said to be
responsible for 90 percent of the world’s junk e-mail, often working
together in loosely grouped “spam gangs,” send their junk e-mail
flying around the globe in numbers that would make a Pentagon accountant
blanch.

The battlefield
is vast, confusing and rapidly changing, as spammers shift the locations from
which they are carrying out their bombardments in order to foil efforts to
trace them. This, in turn, triggers repeated scrambles among the trackers to
find, filter and report the new spam in hopes of getting ISPs to quickly kick
the spammers off their networks.

It is difficult
to tell the players without a scorecard, as many are not who they appear to be.

Virtually every
spammer claims to be a legitimate e-mail marketer who only sends ads to
customers who have “opted in,” or agreed to receive them. But some
who swear they follow such business practices are criminals and cons who use
every ruse available — both technical and rhetorical — to mislead
and obfuscate their true activities.

WHO’S
TELLING THE TRUTH?

The difficulty in determing
who is telling the truth and who isn’t is clearly illustrated by Scott
Richter, 31, who ran bars and restaurants and managed real estate before
jumping into direct marketing four years ago.

Richter told
MSNBC.com that his Colorado company, OptInRealBig.com, is frequently added to
blacklists and other spam registries “not because we do anything wrong,
but because the vigilantes have their own personal agenda against commercial
e-mail.”

But Spamhaus.org,
which maintains the Registry Of Known Spam Operations
(ROKSO), a ledger of world’s most prodigious spammers, says that Richter
is a “long-term professional ‘porn and pills’ spammer who
operates opt-out spamming under the guise of opt-in.”

Ronnie Scelson, a 30-year-old resident of Slidell, La., known as
the “Cajun Spammer,” is one of the few practitioners of the
secretive trade to acknowledge that he uses a variety of dodgy techniques to
get his spam out, but maintains that he does so because anti-spammers have
forced him to take such steps so he can remain in business.

Long considered
one of the world’s biggest spammers but currently in the midst of
bankruptcy proceedings, Scelson said he views his
battle with the anti-spam forces as a defense of the principles of freedom and
the American dream and vows to continue speaking out no matter what the cost.

‘I’M
WILLING TO DIE’

“I’m
willing to die for what I believe in,” he said. “Look at Martin
Luther King (Jr.). When they assassinated him, that’s when everything
changed.”

Others take a
calmer view of the struggle, as they try to make a living either by e-mailing
ads for products and services to consumers or by devising ways to stem or
eliminate the rising tide of spam.

Mary Youngblood,
34, head of Earthlink’s abuse team, said she is
able to put her training as a suicide prevention counselor to good use in
talking to people who have had their accounts canceled for violating the
ISP’s terms of service.

“Having that
training helps me to appraise situations and not to start ticking off people
before I know what’s going on,” she said.

Youngblood also
said that while she loves the thrill of the chase — she and her team
conducted the investigation that led to the indictment of “Buffalo
spammer” Howard Carmack — she
doesn’t go home angry.

“I
don’t take it personal,” she said. “I don’t get
outraged and upset, but it’s a sort of a game that I want to win and I
play hard.”

HACKERS
COUNTERATTACK

It is much harder
to maintain an even keel, however, when faced with the kind of abuse that
members of both camps say they are subjected to on a more or less regular
basis.

Julian Haight, 32, owner of Seattle-based SpamCop.net, had his
resolve tested this summer when he spent many weeks fending off
denial-of-service attacks aimed at crippling his Web site, which helps people trace and report the source of
unwanted e-mail and — for a fee — download spam-filtering software.

One of the
attacks is the result of what Haight described as a
“trojan” virus that, when it is
unwittingly installed on other computers by users who open the file, launches
attacks against the SpamCop Domain Name Server.

“As long as
that code is floating around out there, it’s going to keep
attacking,” he said, adding that the virus apparently was circulated
through spam.

Briton Steve Linford, the 45-year-old founder of Spamhaus.org and keeper
of the ROKSO registry of notorious spammers, said that he is regularly threatened
with another form of “mail bombing” — the kind that explode
in your hands when you open them.

‘PROFESSIONAL
SCUMBAGS’

“They are
so brazen that they’ll issue a death threat against you using their own
e-mail address,” he said of the “professional scumbags” who
end up on ROKSO.

Those on the
other side of the fence say the retribution flows both ways.

Cal Smith, a
73-year-old Canadian who lists his occupation as “spam teacher” and
claims to help “little people, old ladies on the web who are trying to
supplement their income because they can’t make it on their
pension,” said he turned to teaching the techniques of mass e-mailing
because it was safer.

“As soon as
I learned how to do it, then I started to teach it … because spam is
dangerous,” he said. “It’s like walking along the street by a
7-Eleven in a ghetto. You’re going to get mugged all the time.”

Smith and other
e-mailers who say they follow the rules set forth in a confusing patchwork of
state spam laws complain that many anti-spammers make no distinction between
law-abiding e-mail marketers and the notorious spammers who attempt to hide
their identities and frequently market fraudulent products.

ANTI-COMMERCE
‘HATE GROUPS’

“I have a beef against what I consider
hate groups that are trying to shut down commercial e-mail,” said Laura Betterly, 41, the president of Data Resource Consulting
Inc., who said she was threatened and harassed after being dubbed the
“Spam Queen” in an article last November in the Wall Street
Journal.

In addition to
the usual “I know where you live” threats and unwanted magazine and
catalogue subscriptions, she said she was awakened early one Sunday morning by a
phone call from an emergency help line manned by a volunteer at a national bed
wetting association.

“Obviously
there are a lot of people out there with a lot of time on their hands,”
she said. “It’s shocking because I could be highly emotional about
9/11 and teenage pregnancy but, at the end of the day, we’re talking
about e-mail.”

Such complaints
draw little sympathy in the anti-spam community, even among those who calls
such abuse counterproductive.

“They’ve
poisoned the village well and now the villagers have gotten out their
pitchforks, and deservedly so,” said Neil Schwartzman, head of CAUCE
Canada and publisher of “Pete Moss’ SpamNews.”

RUTHLESS
RETRIBUTION

While much of the
abuse heaped on spammers amounts to teenage pranks, the vengeance occasionally
can be criminal and cruel.

Consider the case
of Rodona Garst, a
Clarksville, Tenn., spammer who allegedly had the misfortune to forge the
domain of a network overseen by an administrator with the wherewithal to mount
a forceful response. The administrator, who created a Web site detailing the
case, said the forgery on a series of e-mailings to make it look as if they
originated on his network resulted in “thousands of undeliverable emails
flying back at my mail server.”

The
administrator, who identifies himself on the Web site only as “Man In The Wilderness,” claimed he set a trap for Garst that enabled him to hack into her computer and those
of numerous associates and download 100 megabytes of data. The assembled
evidence made it clear, he said, that Garst and her company, Premier Services Inc., stole e-mail
addresses and passwords from gullible AOL users for use in sending spam, touted
stocks in violation of Securities and Exchange Commission rules and spammed a
wide variety of products, including pornography sites.

To exact a
measure of revenge, “Man In The Wilderness” posted the downloaded
information on the Web site, including instant message logs detailing
conversations among the spammers and, under the heading “Let’s Get
Brutal,” partially nude photos of Garst that he
said were found on her hard drive.

Some of the
allegations on the Web site are unproven. But the SEC, in a settlement of a
complaint against Garst in December 2002, verified
many details of the “pump-and-dump” stock scam and ordered her to
pay the government $15,673 — the amount she realized from stock sales and
fees she earned for fraudulently touting four stocks in her e-mail campaigns.

STOCK
SPAMMERS EXECUTED

While Garst lost her privacy and her ill-gotten gains, spammers
Alain Chalem and Mayir
Lehmann may have paid the ultimate price for their stock-touting activities.

Chalem, 41, and Lehmann, 37, were found shot to
death on Oct. 27, 1999, in the Colt’s Neck, N.J., estate that Chalem shared with his girlfriend and her 13-year-old son. Chalem had been shot in the chest and five times in the
head; Lehmann was shot in the leg and once in the back of the head.

Sgt. Joe
Whitehead of the Colt’s Neck Police Department declined to say whether the
execution-style killings are believed to be linked to the men’s stock
spamming activities, saying only that the case remains under investigation.

While such a
connection remains unclear, Schwartzman, the Canadian anti-spammer, said the
manner of the killings suggests the involvement of organized crime in the stock
scam and underscores the rising stakes and emotions in the spam battle.

“If
they’re killing their own, it’s only a matter of time before
somebody in the anti-spam community gets killed,” he said.

Schwartzman said
the Federal Trade Commission, which hosted a recent workshop on spam, took the
level of animosity into account in preparing a list of speakers that did not
include “frothing-at-the-mouth militants” from either side of the
fence.

NO
‘SETTLERS,’ ‘SUICIDE BOMBERS’

Comparing the
volatility of such a gathering to peace talks in the Israeli-Palestinian
dispute, he quipped, “When you’re searching for common ground, you
don’t invite the settlers and you don’t invite the suicide bombers.”

Despite attempts
to focus the debate, the three-day FTC workshop did not break any new ground.
Participants were unable to agree on a definition of spam, with some in the
marketing community saying the term should be applied only to fraudulently sent
e-mail or advertisements for bogus products and voices from the other end of
the spectrum saying it should apply to any commercial e-mail not specifically
authorized by the recipient.

The presentations
by 87 panelists also underlined the widely held view that there is “no
silver bullet” to solve the spam problem, as FTC officials told Congress
several weeks later. Instead, it will take a combination of legislation, law
enforcement, technology and consumer action to prevent e-mail from being rendered
useless to both individuals and businesses, they said.

In fact, the
workshop’s biggest contribution may have been bringing longtime foes face
to face, said Richter, the Colorado e-mailer.

“It gave
people a chance to see us in a different light … and realize that
we’re not hiding behind closed doors,” he said. “You can find
us. We’re in the phone book and we’re visible.”

But SpamCop’s Haight said the
forum only underlined his sense of foreboding.

“The
spammers are winning in that the legitimate use of e-mail is in decline,”
he said. “It’s sort of like the loss of innocence of e-mail. And
it’s going to get worse. I think it’s going to get to the point
where you can’t send someone an e-mail unless you call them on the phone
first and tell them it’s coming. A lot of people
are at that point already.”

Part 3:

WHO PROFITS FROM SPAM? SURPRISE

Many companies with names you know are benefitting

http://www.msnbc.com/news/940490.asp?0cb=-315171549

By Bob Sullivan

MSNBC

Aug.
8 —  There wouldn’t be spam if there
wasn’t money in spam. So to understand what primes the spam economy,
MSNBC.com answered a single unsolicited commercial e-mail. Following this one
spam trail led us from Alabama to Argentina, from a tiny Birmingham-based firm
and someone named “Erp” past a notorious
spammer named Super-Zonda — and right through
big-name companies like Ameriquest, Quicken Loans,
and LoanWeb. And that’s just the beginning. The
truth about spam is this: While the dirty work is done by secretive, faceless
computer jockeys who are constantly evading authorities, lots of companies with
names you know profit, at least tangentially, from their efforts.

“DON’T
MISS THE lowest mortgage rates in history!” screamed the e-mail, which
urged recipients to visit a Web site to ask for more information on a new home
loan. It claimed to be from “Gay Helms,” but the e-mail address
looked fishy — [email-masked]. Its e-mail headers revealed the note
started its life, not in Canada, as the e-mail address suggests, but in
Argentina, sent from telecom.net.ar. That’s a
sure sign of spam. And, for good measure, it included an infographic
on mortgage rates stolen from MSNBC.com.

Later, with the
help of spam-fighting firm Message Labs Inc., we would learn that e-mail
headers in the note indicate it was sent from an IP address range known to be
used by Juan Garavaglia, also known as “Super-Zonda.” Garavaglia is
believed to send out some 30 to 40 million spam each
day.

But we started with
just one.

We clicked on the
link and were transported to a Web page at LWSMortgage.com, where we filled out
the form with traceable, fake information and waited to see what happened to
our data.

Four days later,
four companies sent us an e-mail indicating they knew we were looking for a new
mortgage: Ameriquest, Quicken Loans, LoanWeb, and Ivy Mortgage, a small mortgage broker based in
North Huntingdon, Penn.

But none of those
companies sent the spam. So how did they get our information?

One of two ways:
They either bought it through third party companies called “lead
generators,” or paid third-party contractors called
“affiliates.”

LEAD
GENERATORS

Lead generators
are behind-the-scenes Internet companies that get lists of consumers they say
are interested in a new mortgage. For each neat package of data provided to a
mortgage company, which includes name, phone number, address, amount of loan
desired, current home value, and other information, lead generators earn about
$20. That’s a small price to pay for a potential $1,000 profit off a new
loan, said Ivy Mortgage branch office manager Brian Jolen,
who couldn’t track our data precisely, but said his company does buy from
lead generators. “Actually, it does work.”

And it works for
spammers, too, who basically split the profits with lead generation companies.
It’s the ideal spam business, said one former spammer who requested that
his name be withheld. Retail sales through spam, like hawking Viagra and
getting tiny per-purchase payments, are hard work. But convincing a consumer to
simply fill out a form is much easier.

“What
always seems to sell well and will always, I know it sounds stupid, are loan
leads. People respond to that. They say, ‘What the hell,’ ”
the former spammer said. “I got $10 to $12 per lead. That’s
good.”

The process also
creates plenty of distance between the mortgage companies and the spammers. In
their initial e-mails, all four mortgage firms were generally vague about how
they got our information.

“I was
notified by one of our vendors, probably off the Web, that you would like
information regarding a home loan,” wrote an Ameriquest
representative.

Quicken Loans was
more specific, but inaccurate.

“Thank you
for requesting more information from Quicken Loans through our Web site,”
the firm’s note said.

ZERO-TOLERANCE
POLICIES

Quicken Loans, Ameriquest, and LoanWeb all said
they do not tolerate spam, and indicated they would research the incident and
take action against whomever was responsible. But only
Quicken Loans revealed exactly where it had purchased our information.

It came from
Mleads.com, a mortgage lead generation company.

Mleads attorney Derek Newman said the firm
doesn’t tolerate spam, and is “careful about policing
affiliates.” Indeed, after a little research, Newman was able to fill out
the picture of our spam’s history, and he said the offending affiliate
was immediately canned.

Newman said the
initial mortgage lead was generated by an affiliate of an affiliate of Mleads, a Birmingham, Ala., company named IC Marketing and
a man who goes by the name “Erp.”

After IC
Marketing received our data, it sold our information to a firm named Infoclear Marketing in Dallas, which then sold it to Mleads, which in turn sold it to Quicken Loans, according
to Newman.

Infoclear immediately terminated its contract with
IC Marketing when it heard about the spam offense, said Patrick Thurmond, who
identified himself as a founder of Infoclear.
Thurmond says such multiple layers of resale are common in the lead business.

CAN’T
TELL WHO’S LYING

“We had one
case last year that went back 15 layers,” he said. “You don’t
know who’s lying to you and who’s not.”

“Erp” — who refused to provide his real name
— said he didn’t sell our information directly to Infoclear. Instead, he actually sold our data to a man
named Rich Nolan, who operates Yourleadsource.com in Colorado Springs, and
Nolan sold it to Infoclear. Nolan confirmed the
assertion in an interview.

But Erp said he wasn’t responsible for the original
e-mail, either. He said he bought it from someone else, who in turn bought it
from someone else, who in turn bought it from an e-mailer based in China. He
didn’t provide contact information for those layers.

IC Marketing doesn’t
send out spam, Erp insisted — his firm merely
resells mortgage leads, gleaning 25 cent or 50 cent profits for each lead sent
up the food chain.

Such is the messy
world of affiliate marketing. Jeff Hain, director of
marketing for LoanWeb, blamed his firm’s
involvement in the spam on an affiliate who acted outside the company’s
policies. The Internet is full of such arrangements, first popularized by
Amazon.com years ago. Small Web sites that push traffic and business toward a
larger firm get a small slice of the profits. It is often tempting for
affiliates to send out spam to create such profitable traffic.

“We have
thousands of affiliates out there,” Hain said.
“When we get complaints, we ask the list owner to provide us with an
audit trail,” including the date and time the e-mail recipient signed up
with an opt-in list.

SYSTEM
RELIES ON COMPLAINTS

But a system that
relies on complaints only works when consumers doggedly hunt down spammers
— and their beneficiaries. Few consumers would go to the trouble of
creating a fake persona to track down the true benefactor of a spam message.
Barring that, the affiliate can get away with it.

In fact, despite
all the noise about spam, actual consumer complaints are rare, says Jim
Gregory, who managed spam abuse issues for Internet service provider
Slingshot.com.

“We had one
guy sending out 1 or 2 million spam a day, and we’d only get 40 or 50
complaints,” he said. And that’s just a complaint about the spam
e-mail itself — which would never make it to the legitimate commercial
company like LoanWeb, the ultimate beneficiary.

Mortgage
companies are hardly alone in the murky world of the spam economy. Such
out-of-control affiliates are frequently used to deflect criticism against all
kinds of unsolicited e-mails.

BLAME THE
CONSUMER

Another popular
deflection tactic — blame the e-mail consumer.

When e-mail
recipients call a retailer to complain, the usual reply is, “you must
have joined a mailing list for one of our partners at some point.” Again,
dogged patience is required to insist that the firm provide an “audit
trail,” which shows exactly when that e-mail address was subscribed to a
list.

That was MSNBC.com’s experience with Kraft’s Gevalia Kaffe, one of the most
popular retail e-mail commercials in circulation today. Gevalia
is subscription-based coffee product sold by Kraft on a Web site, Gevalia.com.
Spam abuse mailing lists are full of complaints about e-mails urging people to
try the luxury European coffee, which includes an offer for a free coffee
maker.

The e-mail offers
arrive many times each day at MSNBC.com. After about a month’s worth of
requests for information, Kraft still hadn’t produced an audit trail for
the e-mail. But it did say it works hard to prevent its affiliates from sending
out spam.

Through an e-mail
interview, company spokesperson Abbe Serphos said, “Gevalia has
no tolerance policy regarding SPAM, and we have strict policies in place that
govern our e-mail communications to consumers.” Some affiliates have been
dropped for breaking those rules, she said, but she wouldn’t elaborate.

A CLASSIC
EXAMPLE

Spam fighter
Laura Atkins, president of the SpamCon Foundation,
said Kraft is a classic example of a company that is quietly benefiting from
spam, and not doing nearly enough to reel in spamming affiliates.

“They are
violating California state law and they don’t care,” she said.

There is only one
effective way to stop out-of-control affiliates, said Dan Clements, who once
operated an Internet advertising network that had several run-ins with
affiliate spammers: Legal action against companies that benefit.

“The way to
stop the spam is to subpoena the beneficiary site,” Clements, who now
runs credit card fraud prevention site CardCops.com,
said. He actually received such a subpoena once, and said when he was forced to
give up contact information and bank account information about his affiliates,
“They scattered like rats.”

ISPS MAKE
MONEY, TOO

An entirely
separate set of companies also benefits from the spam economy — Internet
service providers who carry their traffic.

Well-known spam
nemesis Ron Scelson filed for bankruptcy earlier this
year, and a review of bankruptcy documents shows he owes Bell South $56,463 for
“circuits” and Cable & Wireless another $4,407 as his
“Internet provider.” Neither company responded to requests for
information about the bills.

But it’s
hardly the first time a big-name Internet provider has been caught in a deal
with a spammer. In an embarrassing incident for both AT&T and PSINet three years ago, both firms were caught as
participants in secret “pink contracts” with spammers. Long
suspected in the spam world, the revelations exposed pink contracts as
sweetheart deals for the Internet firms, designed to protect spammers. ISPs get
premium, well above normal rates, to sell bandwidth to known spammers. In
exchange, the ISP agrees to suffer more than normal complaint rates. In PSINet’s contract, revealed on News.com, the firm
received an upfront payment of $27,000 from Cajunnet,
a marketing firm based in Slidell, La. In exchange, PSINet
agreed to permit Cajunnet to send unsolicited email
“in mass quantity” through PSINet’s
lines.

‘MANY
MORE’ OUT THERE

No such
embarrassing pink contracts have been disclosed since 2000, but many spam
experts say they still exist — either formally or informally.

“There are
many more rumored to be out there,” said Ray Everett-Church, chief
privacy officer for ePrivacy Group. “There are
companies that have had more than enough complaints about a current customer to
know some are engaged in massive spamming and yet they remain connected for
weeks and months at a time. ... It’s evident somebody is either not doing
much research before they sign people up, or in the worst case, they are just
flat out ignoring complaints.”

But
the problem doesn’t have to be that sinister, said Gregory, the former
ISP spam hunter. The problem is often just a question of resources, he said
— ISPs have a much larger sales staff than network abuse staff. One major
ISP often only had one staffer working in the spam complaint department, he
said.

“They have
to argue for resources all the time,” he said. By default, spammers can
get away with it for weeks or months, he said.

The struggling
economy, which has hit Internet service providers particularly hard, has
tempted some ISPs to take the tainted money, Everett-Church said.

“You’ve
got a lot of sales forces being approached by folks willing to pay a little
extra for reliable connectivity, and looking the other way on contract
provisions enforcing antispam rules to keep getting
paid those premiums.”

Gustavo Monserrat, who fights spam at Argentina’s Telecom
— the ISP where the mortgage spam cited at the top of this story began
its life — admitted as much in a post to the spam abuse Internet
newsgroup in May.

QUICK
RETURN

“Many
customers have been unplugged due to spam reasons and due to a system’s
issue some have rebought our services under different
names/credit cards/phones,” he wrote. In “one case, we actually
separated a customer from our network but hours later our money-thirsty
salesmen sold him the service again.”

In a follow-up
e-mail, Monserrat said his company has new procedures
in place to stop spammers from re-upping with his ISP once they are
disconnected.

But in a
struggling economy, the premiums that spammers will pay can be hard to resist,
said Spamhaus.org’s Steve Linford.

“Most
of the ISPs are good to their word and are fighting it very, very hard,”
he said. “But as you get into the larger ISPs, especially those that are
in any form of financial difficulty, the engineers, abuse staff and technicians
all want the spammers off the network, but you have the sales staff looking at
the money. … The engineers will be fighting internally with the sales
managers, but of course the sales managers always win.”

So with money
always there to prime the system, spam won’t stop, said one small-time
spammer MSNBC.com interviewed. In his mind, there is only one solution:
Consumers have to simply stop answering spam, making it finally not worthy
anyone’s while to send it.

“The only
thing that’s going to make spam go away is if people do not
respond,” he said. “When e-mail first started, you could send out
50,000 e-mails a day and make money. Now you have to invest a lot of money and
time, you get a return rate of less than one-tenth of one percent. One day it
will become so you can’t send enough to make any money. And that’s
the only thing that will stop spam.”

Part 4:

THE SECRET TRICKS THAT SPAMMERS USE

From ‘bullet-proof hosts’ to spam clubs,
here’s a look

http://www.msnbc.com/news/940853.asp?0cb=-415171549

By Bob Sullivan

MSNBC

Aug. 11 —  Joe Stewart was poring over the
complex computer code of a widespread new virus named “SoBig,” wondering what it was really designed to do.
Then it hit him. This was not your typical attention-getting nuisance. The
virus, he says, was actually designed to hack into home users’ computers
and quietly use them to send out spam. In the secretive world of spammers,
where dirty tricks are standard practice, this was the dirtiest trick yet.

SPAMMERS LIVE IN A
CAT-AND-MOUSE world, where survival means staying one step ahead of the people
and technology that are giving chase.

The game began simply, long
ago, with a single e-mailer sending out multiple messages from an account,
which was shut down by the e-mail provider.

But the battle for spam is a
war of escalation. To get their messages out, spammers have taken to more and
more unsavory tactics; they bounce their e-mails around the world, break into
insecure university computers and launch spam campaigns from there, even steal
long-distance telephone service to sneak onto dial-up Internet accounts.

As a countermeasure, some in
the anti-spam movement have taken to ignoring e-mail that comes from certain
parts of the Internet, which foils most of the tactics described so far.

“You implement one new
technology hurdle, that slows them down for days or weeks,
but they eventually adapt,” said Ray Everett-Church, chief privacy
officer for ePrivacy Group.

And now,
this latest adaptation. The worlds
of computer virus writers and spammers have merged, says Stewart. Trojan horses
are being placed on home computers around the Internet, making them willing
accomplices to spam campaigns. Hiding behind the IP address of a home computer
is nearly the perfect disguise.

“It makes it very hard
to trace back to the spammer,” Stewart said.

SPAMMERS NOW HACKERS

Researchers say hundreds of
thousands of vulnerable computers are being used to launch spam campaigns now.
In fact, 70 percent of all spam is now sent this way, according to anti-spam
firm Message Labs Inc. — and perhaps 6 to 7 billion spam messages are
routed through hacked home computers.

“A lot of ex-hackers,
the black hats, they go into spamming,” said computer security expert
Joel de la Garza. “And they are making a lot of money from that.”

For some, the tactic is the
stuff of science fiction. Earthlink spam fighter Mary
Youngblood now spends a lot of her time calling innocent victims telling them
their computer is being used for spam. Often, they just don’t believe
her.

“Some people say,
‘You’re insane. My machine is fine. I haven’t gotten any
complaints,’” she said. “We get lots of ‘experts’
that swear up and down, ‘No, no, you are completely wrong.’ ”

MOST WORK AT HOME

Youngblood’s abuse team
of 12 is part of a close-knit network of spam fighters at all U.S. Internet
service providers who play the cat in this contest. While hacking into
vulnerable computers, called “open proxies,” is the latest trend in
spam, it’s just one of the popular tools used by spammers to evade their
pursuers. The spammers’ world is a constant search for bandwidth that
won’t get turned off, e-mail software that helps them hide, and companies
that really will pay them for selling Viagra or Iraqi Most Wanted cards or
penis enhancement products.

But it’s not a world of
high-tech genius million-dollar computer systems. Most spammers work at home,
using jury-rigged networks and software they’ve cobbled together with
help from other spammers they meet in secret “spam clubs.” On these
member-only Web sites, targeted address lists are shared, illicit bandwidth is
bought and sold, and bulk e-mail software is discussed. Much like the
underground world of credit card thieves, it’s full of name-calling and
accusations, and a constant, desperate search for reliable bandwidth.

10 MILLION A DAY

One former spammer
interviewed under condition of anonymity by MSNBC.com said he simply had four
computers and two cable modems in his operation. With that setup, he said, he
was able to send out 10 million e-mails a day.

“The computers were
running all day, 24 hours a day,” he said. “You need to send about
500,000 an hour to make any money.”

In fact, some spammers have
an even a simpler setup, which can be harder to track. When Earthlink
sued to stop spammer Harold Carmack, he was just connecting
to their systems using old-fashioned dial-up accounts. Youngblood, who led the
investigation into Carmack, said dial-up lines can be
the hardest to trace. Newer circuits have caller-ID-like technology called ANI
that can reveal exactly where a local telephone call is placed when it dials a
modem pool; older phone lines don’t. Carmack
tried to evade Earthlink investigators by using local
dial-up numbers from around the country. But he stumbled onto enough
ANI-enabled lines that Earthlink was able to hunt him
down.

BULLET-PROOF HOSTS

Evading the hunt is the chief
task for all spammers, and it’s harder than it sounds. Nearly all spam
has two components — the initial e-mail, and a companion Web page. The
e-mail drives traffic to the Web site, where spam recipients are asked to fill
out a form or buy a product. Both components have to work; if either one is
shut down, the spammer can’t get paid.

That’s why spammers pay
hundreds, and sometimes thousands of dollars a month for what’s known as
“bullet-proof hosts.” Such Web providers, with names like
“Steel-Space,” promise their sites won’t get pulled down,
even in the face of a deluge of complaints. Commonly advertised around the
Internet as “bulk e-mail friendly Web hosting services,” many claim
to operate offshore, far from U.S. legal subpoena power and the e-mail
complaints of an English-speaking audience.

But other spammers contend
that most of the dirty work is still done in the U.S. “There is no such
thing (as an offshore server),” wrote one. “Offshore
servers is a polite way of saying vulnerable, technologically challenged
servers.”

Of course, distributing the
spam e-mail itself is the first and most important step. For that, spammers
turn to bulk e-mail software like Send-Safe, which allows them to fake the name
listed in the “from” line.

Most e-mail addresses at this
point come from e-mail harvesting programs, which search the Web like Google,
culling the millions of e-mail addresses listed on Web pages or in Newsgroup
posts. Spam clubs offer e-mail lists, too — some even claim to be
targeted. One club viewed by MSNBC.com promised regularly updated lists in
categories as narrow as “actors and actresses.”

E-mail lists are for sale,
too: some sites promise to divulge as many as 30 million e-mail addresses for
under $100.

And to streamline the process
further, spammers can pay someone else to do their dirty work. For about $350,
many sites claim to do the entire process for you, delivering 1 million e-mails
to consumers they say have “opted in” and are looking for offers.

CONFUSION IS THE BEST TOOL

But perhaps the most powerful
tool in the spammer’s arsenal is plausible deniability. Spam complaints
are always met with a response that the consumer volunteered for e-mail offers at
some point. Usually, a “marketing partner” or affiliate is blamed.

A former employee at an
e-mail marketing company that claims to engage in only opt-in
marketing campaigns revealed just how this works, under condition of anonymity.

When she worked there, people
were constantly added to “opt-in” lists
whether they opted in or not, she said. Frequently, marketers approached her
firm with e-mail lists and spam campaign e-mails. Her company never asked where
the e-mail addresses came from; it certainly didn’t require proof that
the consumer had “opted in.” When complaints came, they pinned the
problem on the partner. And remove requests were completely ignored, she said.

“I checked myself when
I was working there to see how many people had my e-mail address. And I was on
15 lists. And I had never signed up for anything. It was disgusting,” she
said. “They tell people they must have subscribed. But that’s just
not true.”

Part 5:

CONGRESS TARGETING OUTLAW SPAMMERS

But firms could still send unsolicited ads under top
bills

http://www.msnbc.com/news/948022.asp?0cb=-515171549

By Mike Brunker

MSNBC

Aug. 12 —  Internet
users say they’re choking to death on spam, but they may not get much
breathing room from legislation expected to be adopted by Congress this fall.
In a test of how well commerce and communication can coexist, the lawmakers
appear determined to pass a bill that will target the “bad actors”
of the junk e-mail world but do little to reduce unsolicited pitches from direct
marketers and other businesses.

GIVEN THE RISING
level of public frustration over spam, both supporters and opponents of various
bills working their way through Congress say they expect lawmakers to pass spam
legislation this fall, after nearly four years of unsuccessfully grappling with
the issue.

But with eight
separate bills on the table, the exact formula by which the lawmakers will
attempt to address what is by all accounts a highly complex problem remains
very much in flux.

The leading bills
at this point — known as the CAN Spam Act in the Senate and the RID Spam
Act in the House — are expected to undergo changes in the coming weeks as
provisions of competing legislation are incorporated to broaden support. But
sources familiar with the negotiations say that some aspects of the final
product are becoming clear.

Both bills would
prohibit the sending of e-mail that attempts to disguise its source or contains
deceptive subject lines and would require advertisers to include both an
“opt out” mechanism and accurate contact information.

They also would
impose some new criminal and civil penalties on spammers who violate the law
and allow Internet service providers — but not consumers — to sue
those who don’t abide by the rules.

‘DO
NOT E-MAIL’ LIST IN TROUBLE

Apparently out of
favor is an approach advocated by Sens. Charles
Schumer, D-N.Y., and Mark Dayton, D-Minn.: creation
of a “do not e-mail” list similar to the “do not call”
registry recently put in place by the Federal Trade Commission to enable phone
customers to opt-out of telemarketing calls.

Opposition from
marketers and concerns voiced by the FTC and others that the list would fall
into the hands of unscrupulous e-mail marketers apparently have doomed the
concept, although Schumer is expected to make a final attempt to add it to the
Senate’s spam legislation.

The proposals for
a “do not spam” list were the closest lawmakers came to the
“opt-in” method favored by most anti-spam groups, which would
require advertisers to get permission from consumers before sending them their
advertisements.

This is the
approach adopted in July by the European Union, which instructed its 15 member
states to adopt legislation banning the sending of spam without prior consent
by Oct. 31. Numerous European lawmakers have expressed concern that the passage
of legislation in the United States based on an “opt-out” model
will render the European laws moot, since most of the spam that reaches Europe
originates in the United States.

A federal spam
law also would erase tougher anti-spam laws on the books in several of the 35
states that have enacted spam legislation since Nevada became the first state
to take the plunge in July 1997, a key issue for commercial e-mailers.

“With
e-mail crossing state borders so readily and with organizations often unsure
where the recipient resides, pre-emption of state laws becomes absolutely
necessary,” said Al DiGuido, CEO of Bigfoot
Interactive, which does “permission-based” e-mailing for 150
companies. “Without pre-emption, there simply is no easy way to uphold,
react to or manage the proliferation of state-imposed legislation.”

But because the federal
legislation apparently will be based on the “opt-out” model, which
would require consumers to ask advertisers individually to remove them from
their e-mail lists, anti-spam groups argue that it will actually increase the
spam volume by sending businesses that have previously stayed on the sidelines
stampeding to the Internet.

“There are tens of
millions of businesses that would like to advertise directly to
consumers,” said Jason Catlett, president of Junkbusters.com, a New
Jersey-based organization fighting the proliferation of what it calls
“junk advertising.” “If you spent the best part of your working
day opting out from your spam, and you did it diligently for six months, you
might reduce the amount of spam you get.”

‘POTENTIAL 200
MILLION SPAMMERS’

David Sorkin,
a law professor at the John Marshall School of Law and creator of the
spamlaws.com Web site, echoes those fears.

“The big
concern I have is not about the 200 bad spammers now but the potential 200
million spammers,” he said.

But supporters of
the legislation taking shape on Capitol Hill — including direct marketers
and big Internet service providers like AOL and Microsoft, owner of MSN —
say that a “significant reduction” in unsolicited commercial e-mail
can be achieved by going after the renegade spammers believed to be responsible
for the vast majority of spam.

“This bill
gives power to consumers to say ‘no more’ and provides a
multi-tiered, very aggressive enforcement structure to go after the worst
actors,” said Carol Guthrie, a spokeswoman for Sen. Ron Wyden, D-Ore.,
co-author with Sen. Conrad Burns, R-Mont., of the CAN Spam Act.

Supporters of the
legislation acknowledge that a federal law alone won’t solve the spam
problem. Also necessary, they say, will be a stepped-up enforcement effort,
improved global cooperation and better filtering technology.

But Louis Mastria, a spokesman for the Direct Marketing Association,
which represents nearly 500 direct mailers and marketers and has thrown its
support behind CAN Spam and the RID Spam bill, by Rep. Richard Burr, R-N.C.,
said anti-spammers are simply “trying to scare people” with their
predictions that the legislation will trigger a deluge of junk e-mail.

“Marketers
are going to be very sensitive to volume,” he said. “… Losing
a customer (by ignoring his or her wishes) is a horrible thing because
it’s nearly impossible to get that customer back.”

In addition to
support from direct marketers, sources say the CAN Spam and RID Spam bills have
climbed to the top of the legislative pile thanks in part to support from some
of the leading e-mail providers, including AOL and Microsoft, which operates
MSN, as well as Internet portal Yahoo, all of whom have complained loudly about
the financial toll that spam inflicts on their networks. (MSNBC is a joint
venture of Microsoft and NBC.)

LAW MUST
‘EMPHASIZE THE DISTINCTION’

Ira Rubinstein, an
associate general counsel for Microsoft, defended the company’s efforts
to shape anti-spam laws as necessary to preserve the commercial promise of the
Internet.

“From a
policy standpoint it is very important to emphasize the distinction between
legitimate e-mail and what everyone would agree is a typical case of spam
… and (to) propose legislative remedies that reinforce that distinction
and restore confidence in the use of e-mail as legitimate communication by
legitimate companies,” he said.

He added that
Congress can play an important role in reducing spam by cracking down on
renegade spammers, but said it should not “burden all online
commerce” by imposing onerous regulations and harsh penalties because
filtering technology is rapidly returning control to consumers.

Rubinstein said
that Microsoft also favors creation of a self-regulated industry group that
would offer commercial incentives for e-mailers who adopt and abide by
“best practices” rules. The incentives for advertisers to
participate in the monitored program would be the right to display a digital
seal indicating that the sender is in compliance with the standards and
“presumption of compliance,” which would require complaintants to meet a higher standard of evidence to show
that a company had violated the rules, he said.

Sources at AOL,
who briefed MSNBC.com on the company’s lobbying efforts on condition of
anonymity, said the company has not taken positions on specific bills, but has
urged Congress to take a two-pronged approach to spam by requiring an
“opt-out” mechanism and clear identification of the source of the
mail coupled with strong criminal and civil penalties for spammers who resort
to fraud, falsification of headers, hacking or other illicit methods to send
their e-mail.

Like Microsoft,
the company believes such measures will compliment improving filtering
technology and put consumers back in control of their inboxes, the sources
said.

Yahoo
representatives did not return calls seeking comment.

UNINTENDED
CONSEQUENCES FEARED

The ISPs’
position has support in some quarters without a direct stake in the outcome.

Clyde Wayne Crews
Jr., director of technology policy at the Cato Institute, a libertarian-minded
think tank, said he thinks that federal legislation could have unintended
consequences if it isn’t carefully targeted.

“The
Internet is already suffering and you have to be careful that you don’t
create a situation where the good guys get swept under and become terrified to
use the Internet,” Crews said.

But several
sources familiar with the Internet companies’ lobbying efforts told
MSNBC.com that during discussions with lawmakers and their staff members, the
firms’ representatives have appeared to be more focused on protecting a
potentially lucrative revenue stream rather than combating spam.

“One of the
ironies of all this is that while the industry wants to reduce the amount of
spam going through their networks, some of the bigger ISPs are opposing more
stringent measures because they use spam to market their products,” said
one source, who like the others spoke on condition of anonymity. “They
want a measure that directly impacts the rogue spammer, but doesn’t
directly address the underlying issue.”

Another source said
the companies’ stance reflects a mistaken belief that the public is
willing to accept advertisements for their products and services if the offers
for body-enhancement products and pleas from Nigerian widows are excised from
their inboxes.

“They
don’t recognize that their stuff is regarded by many people as
spam,” the source said.

The big ISPs have
not marched in lockstep on spam legislation.

Earthlink, for example, indicated a willingness to
accept an opt-in standard.

“I think
from a consumer perspective, ‘opt in’ would be the ideal standard
because otherwise every online merchant gets at least one free spam, which
would put a burden on consumers,” said Dave Baker, vice president of law
and public policy for Earthlink. “But as a
practical matter, virtually every piece of legislation adopts an opt-out
standard, so that appears to be the reality of what we’re dealing
with.”

DELIVERY
REQUIREMENT OPPOSED

However, Earthlink is in agreement with AOL and Microsoft that the
law should not require ISPs to deliver commercial e-mail, even if the senders
comply with all the rules.

“There can
be no restriction on an ISP’s current ability to block spam on behalf of
its customers,” Baker said. “We’re not going to get into a
situation where a direct marketer says to an ISP, ‘You have to deliver my
messages.’”

While much of the
maneuvering by stakeholders in the spam debate has quietly taken place in
discussions with legislators and staffers, Microsoft suffered a public black
eye this summer when a California lawmaker accused the company of killing what
would have been the country’s toughest anti-spam law.

The 5-2 vote by
an Assembly committee to kill the bill by state Sen. Debra Bowen, D-Redondo
Beach, came on July 1, the same day that Microsoft announced it was suing 15
spammers for allegedly abusing its network. Some observers saw the timing of the
announcement as an effort by the company to divert attention from its role in
California.

In a statement
issued after the vote, Bowen ripped the Redmond, Wash.-based software
manufacturer for lobbying against her bill, which was patterned after the federal
law banning unsolicited junk faxes.

“Microsoft
doesn’t want to ban spam; it wants to decide what’s
‘legitimate’ or ‘acceptable’ unsolicited commercial
advertising so it can turn around and license those e-mail messages and charge
those advertisers a fee to wheel their spam into your e-mail inbox without your
permission,” she said.

Bowen told
MSNBC.com that Microsoft was particularly concerned about a passage in the bill
that would have allowed consumers to sue advertisers who violated the law for
$500 per spam - a penalty that could have been tripled by a judge if it was
determined that the advertiser did so “willfully and knowingly.”

“I wanted
to make sure we could go after the big spam houses,” she said.
“… Microsoft said, ‘We want to make sure we don’t get
caught up in the litigation.’”

RIVAL BILL
PREFERRED

Rubinstein, the
Microsoft spokesman, said only that the company preferred a rival measure by
state Sen. Kevin Murray, D-Los Angeles, over Bowen’s bill and made its
reasons clear to legislators.

“In many
states, we’ve been applauded for our efforts; in others, we’ve been
subjected to political disagreements,” he said of Bowen’s comments.

He also said
that, while Microsoft recognizes that emotions run high on spam, it
doesn’t believe that the positions it has taken on legislation will
trigger a public backlash against the company.

“If there
is an outpouring of anger, I don’t think it will be because of a stand we
have taken on legislation,” Rubinstein said. “It will because the
efforts now under way on legislation, enforcement, technology and
self-enforcement have failed. … And then it will be deserved.”

The World’s Top Ten Spammers

Eddy
Marin

This Boca Raton, Fla.-based
e-mailer recently earned the title of “World’s No. 1
spammer” from Spamhaus, which says he is
capable of cranking out 50 million e-mails a day by himself
and 250 million a day if he farms work out to other members of his
“spam gang” in south Florida. A Colombia born former Pompano
Beach nightclub owner and online porn entrepreneur with cocaine dealing and
money laundering convictions on his record, Marin, 41, goes to considerable
lengths to avoid unwanted intrusions on his privacy. He is only known to have
given one interview – to the Miami Herald in 2000, during his days as a
would-be porn kingpin – when he told the newspaper that he had
downsized what was a struggling live Web cam site and was instead focusing on
developing, hosting and doing marketing for other Web sites. Doing business
as “Opt-In Services,” he told the newspaper at the time that he
had generated revenue of $750,000 during the first quarter of the year --
"over 80 percent profit" -- and indicated he was beginning to focus
on marketing data bases and "opt-in mailings." Marin was formerly
partnered with another notorious spammer, Thomas Cowles, but the two
apparently had a falling out.

George
Rand

An exceptionally low-profile
fellow, even by spammer standards, Rand has registered two businesses in New
York but may reside or also do business in Miami. He has been known to spam a
wide variety of products and services, including bogus penis-enlargement
pills, anti-terrorism T-shirts, bad-credit repair and even inspirational golf
balls for Christian golfers, according to posts to anti-spam Usenet groups.

[no photo available]

Alan
Ralsky

Ralsky, who is in his late 50s, has been among the
nation’s biggest spammers since entering the business in 1997 while
recovering from bankruptcy – one of nine filings dating back to 1993 --
and the loss of his insurance license. Previously, while living in Illinois,
he was convicted of felony fraud and “failing to deliver a
contract” involving unregistered securities. Ralsky
has boasted in various media interviews that he has the capability of sending
tens of thousands of e-mails an hour pitching such products and services as
mortgages, vacations, online pharmacies and casinos for clients, relayed
through servers in the United States and abroad. He was sued in 2001 by
Verizon in a landmark lawsuit seeking $37 million in damages for allegedly
twice paralyzing the company’s network by sending bulk e-mail. In an
October 2002 settlement, Ralsky agreed to pay an
undisclosed amount to the company and refrain from sending spam on any of
Verizon's networks. After his address and photos of his new $740,000 home in
West Bloomfield, Mich., were published on the Web late last year, Ralsky was subjected to probably the biggest revenge
mailing of the spam wars when anti-spam crusaders signed him up for every
magazine, brochure, catalog and junk-mail offer available. "These people
are out of their minds. They're harassing me," he told the Detroit News
in December.

John
Ritzer

John Ritzer

Little is known about this
Anaheim, Calif.-based spammer, who also uses the nom de spam “Jack
Ross,” except that he has been very busy for the past several years. Ritzer, who does business through at least three entities
– JR Marketing, M&J Marketing and National Mortgage Funding Inc. -- is believed to be in his mid-30s. He is an associate of
No. 3 spammer Alan Ralsky (he has at times used his
servers to host Web sites and domains for Ralsky)
and specializes in mortgage and loan pitches.

[no photo available]

Juan
Garavaglia

Garavaglia, who also goes by the name Al Vaglia,
is an apparent newcomer to spamdom’s top
tier, first appearing on the Spamhaus radar about
six months ago under the sobriquet “Super-Zonda.”
He also is believed to be the lone South American representative on the list,
working out of Buenos Aires. The reason for the uncertainty about Garavaglia’s whereabouts is that he is a master at
hiding his tracks and quickly shifting locations as he uses insecure
computers to send e-mails and host Web sites. The British Broadcasting Corp.
reported recently that “Super-Zonda”
was able to use an insecure British Airways Web site to send out spam for a
Russian mail order bride site.

[no photo available]

Eric
Reinertsen

A longtime spammer from
Florida, which has emerged as the world capital for unsolicited commercial
e-mail, Reinertsen has a host of domains set up on
servers far and wide to aid in his high-volume operation. Like many of the
others on the Top 10 list, he also uses such illegal ploys as hijacking of
mail-servers to further his ability to get out the junk mail. Best known now
for sending out investment “tip” e-mail, he recently caused a
stir by allegedly sending spam on behalf of Fox Sports. In May 2001, he
proclaimed in a news group posting that he had been wrongly accused of
spamming, saying that the company name he was identified with at the time,
datastreamgroup.com, had been victimized by a hacker who sent out e-mail
“forged with our email address … (and) sent out from a prserv.net
dialup relayed through a Korean server. We have this matter under
investigation with the authorities and various ISPs.”

[no photo available]

Mike
Cunningham

Working with associate
Andrew Amend under the U.S. Health Laboratories aegis, Cunningham is a major
source of e-mail offering cut-rate Viagra and offers covering “all
kinds of medical quackery,” according to Spamhaus’
Steve Linford. Operating out of Hayes, Kan.,
Cunningham and others created an ISP – Katelecom.com – in 2001 in
order to hide from their provider, Sprint. The ruse worked for a while, as
tens of thousands of spam complaints were sent to [email-masked]
rather than Sprint. Cunningham describes himself as a devout Christian and
claims to have attended a Baptist college in Iowa, where he engaged in
extensive studies of the New Testament. He also is or was a member of an
obscure spiritual music-comedy act, “Hugh Myrr
and John Donut.” Cunningham also vowed in a posting to a message board
used by spammers to defend his “God-given right to spam.”

[no photo available]

Gaven Stubberfield

Stubberfield is the leader of a group of spammers based in the
Raleigh, N.C., that specializes in e-mailings promoting porn sites, including
a particularly notorious piece offering a free video involving bestiality
between a teenage farm girl and her horse. Until January 2003, when they
apparently were sent packing by their ISP, Stubberfield
and friends had a high bandwidth T-1 line and multiple computers that pumped
out spam around the clock. Stubberfield also has
dabbled in illegal pyramid e-mail scams and a purported “business
opportunity” making money off unclaimed Federal Housing Administration
homeowners’ insurance policies, both of which were vigorously promoted
by spam.

[no photo available]

Carl
Henderson

Under the Ultimate Health
banner, Henderson spams a variety of fraudulent health products, including
human growth hormone (HGH) and miracle weight-loss and breast-enlargement
pills and creams. Henderson survives by being quick on his feet, changing
domains quickly and using Chinese ISPs to advertise Web sites on pirated
Chinese servers, including some belonging to elementary schools in China.
Bogus contact information in “whois”
records points to many states, but some of his Web sites gave an address in
Madison, N.J., that may have been his base of operations at one time.
Henderson either uses the alias “Harry A. Creaghan”
at times or has a business associate by that name.

[no photo available]

DocDrugs/Pinnacle Meds

This apparently
Florida-based “spam gang,” which has so far managed to remain
anonymous, controls an array of domains on which it hosts numerous mirrored
online drugstores specializing in sexual-performance, weight-loss and other
health-related products. The “mother ship” of the drugstore suite
is ultrameds.com, which has been hosted for long stretches by the Internet
access company Ifxcorp, which does most of its
business in South America. Although the spammers have been able to avoid
detection, they haven’t been so diligent in protecting the identities
of their customers and affiliates, according to a Usenet posting last year.
The poster said that due to sloppy ASP coding, the group was exposing
“customers’ credit and medical details to the world,” as
well as the names and locations of some affiliates. The “whois” records for DocDrugs
and related sites contain false contact information, but many of the records
list addresses in Aventura, Fla., suggesting this
outfit may be based there.

[no photo available]