MSNBC Special Report on Spam

3DMSN.com

Part 1:

HOW UNWANTED EMAIL IS BURYING THE INTE= RNET

http://www.ms= nbc.com/news/941040.asp?0cb=3D-115171549

By Bob Sullivan<= /o:p>

MSNBC

3D"Spam Aug. 6= — About 14 billion spam are sent each day now R= 12; two for every person on the planet, according to one study. Actually, two a= day wouldn’t be so bad. In reality, many Net users say they are drowning = in the

s= tuff. The unrelenting deluge of unsolicited e-mail m= akes finding real e-mail from mom or the boss harder every day. So some are thro= wing up their virtual hands, and dropping old, beloved e-mail addresses in a vain attempt to run away from the bursting dam that is their Internet service provider. Spam, some say, has gotten so bad that it’s on the verge of killing e-mail. But if the Internet sky really is falling, why doesn’t someone do something?

EARLIER T= HIS YEAR, a line was crossed. In May, there was more spam than real e-mail flyi= ng around the Internet, according to spam-fighting firm M= essageLabs Inc. And at just about that point, Uncle Sam — specifically, the Fede= ral Trade Commission — decided to call an old-fashioned town meeting.

&nbs= p;

Just how emotional has the spam issue become? At Uncle Sam’s meeting, a fistfi= ght almost broke out. And that was before a marketing company used the everyone-invited-to-the-table forum as an opportun= ity to serve spam fighter Allan Murphy with a subpoena. As anyone in the room would say, the issue of spam had reached the flash point.

&nbs= p;

Whatever = measures the e-mail providers have been attempting to plug the dam, they just aren’t working. Despite all manner of new technology, legislative act= ion, lawsuits, and outright bodily threats, the spam dam keeps springing leaks. = And many fear the worst is still yet to come.

&nbs= p;

Pick your favorite staggering statistic to make the point — both consumers and corporations are crying out for help. Radicati = Group says spam will cost companies $20.5 billion in 2003 and that by 2007 busine= sses will be forking over nearly 10 times that amount of money, or $198 billion,= to battle spam. Jupiter Research says U.S. e-mail users received more than 140 billion pieces of spam in 2001 and an estimated 261 billion pieces in 2002 — an 86 percent increase. AOL says it blocks 2.3 billion spam e-mails every day. BellSouth says spam will soon add $3 to $5 to each customer̵= 7;s monthly bill.

&nbs= p;

“E-= mail is on the tipping point of becoming more trouble than it’s worth,” says Ray Everett-Church, chief privacy officer at ePri= vacy Group.

&nbs= p;

Or is it?=

&nbs= p;

Only a fe= w months earlier than the FTC forum, the Pew Internet and American Life Project rele= ased its own e-mail and spam study, and it included this startling pronouncement: Spam isn’t that big a problem. A noisy, wired minority, the report sa= id, has overexaggerated the spam jam-up. In fact, o= nly 15 percent of workers surveyed say they have to deal with more than 50 e-mails= a day. And nearly three-quarters said “only a little” of their wo= rk e-mail is spam.

&nbs= p;

NO = BIG DEAL?

Peter S. = Fader, a marketing professor and spam expert at the Wharton School, thinks that far = too much has been made of the spam issue — it’s only a minor annoya= nce to most Internet users, he said.

&nbs= p;

“People notice spam because of the negative novelty, but it’s not really that= big a part of their life. But if you give people a choice and say, ‘We’ll take the spam away but your e-mail will come in more slowly,’ people would say, “Give me the spam,’ in a heartbeat,” he said. “It is just a phase we’re going thro= ugh. Two years from now, we’ll look back on the spam thing and laugh.̶= 1;

&nbs= p;

Anti-spam= advocates, however, are hardly laughing. But the disconnect= over how bad the problem is might partially explain why spam remains so bad for = that noisy minority — perhaps the sky, and the Internet, really aren’= ;t falling. Clearly, Everett-Church says, while nearly everyone with a stake in the issue claims the problem is dire and dramatic, corporate and legislative actions to resolve it have been slow and considered.

&nbs= p;

Among lar= ge Internet companies, who regularly cry the loudest about spam costs, action against spammers has been only incremental.

&nbs= p;

“Th= e talk is at variance with the walk,” he said.

&nbs= p;

WHY CAN’T WE FIX THE DAM?

&nbs= p;

The chief obstacle to solving the spam problem is that there isn’t even yet consensus on what spam is. Many Net users would simply say it’s any e-mail they didn’t expect. But plenty of companies feel they can righ= tly contact customers with relevant information, and that consumers often want = such a targeted service. To them, only misleading unsolicited e-mail is spam = 212; that is, e-mail where the true sender is intenti= onally obscured, or an e-mail message that makes fraudulent offers.

&nbs= p;

Legitimate companies, this world view holds, should get at least one chance to e-mail people with an ad, the so-called “one bite” approach. And consu= mers who opt in for e-mail offers, well, they are fair game.

&nbs= p;

But while= the debate takes place, the gray area becomes wider, and e-mail marketing compa= nies with questionable practices have an easy time finding cover.

&nbs= p;

“Th= e line between legitimate direct-mail marketing companies and spammers is very fine,” said Brian Czarny of Message Labs. “The spammers are good at presenting themselves as direct-marketing companies.”

&nbs= p;

The truth= is, while spammers are on the run, they are still winning the race against corporations and government officials trying to shut them down. For every spammer put out of business by a lawsuit, probably hundreds of newbies are being trained in secretive “spam clubs” around the Internet. For every account shut down for illegal activity, thousands more open up. Technology such as spam filters or blacklisting techniques can only accomplish so much. In the end, the Intern= et still makes things much too easy for the bad guys to hide, too easy for the= m to pretend to be an old girlfriend or a co-worker and get you to click on their e-mail.

&nbs= p;

PEO= PLE DO BUY, DON’T COMPLAIN

&nbs= p;

And peopl= e do click. Few will admit it, but several interviews with spammers have revealed some products really do sell via unsolicited e-mail marketing. On a good da= y, a sophisticated spammer might have to send out 10 million e-mails to get 40 o= r 50 positive responses — but if they are requests for more information on= a new mortgage, the spammers just made $10 for each response, or $400 to $500. Not a bad day’s work.

&nbs= p;

In fact, according to some abuse desk workers, about as many people buy from spam e-mails as complain about spam e-mails. A 2 million message mailing will generate 40 or 50 complaints, according to Jim Gregory, a former spam fight= er at now-defunct ISP Slingshot.com. And without complaints, no spammer is ever shut down.

&nbs= p;

So for no= w, the fight about spam is limited to a relatively narrow cast of characters:

The anti-spam radicals, = who chase after spammers with a quiver full of high-tech tools.=
The king spammers, the 2= 00 or so bulk e-mailers responsible for perhaps 90 percent of the worlds’ spam.
The small-time spammers, disciples of the king spammers, who are trying to get rich quick via a modem.

Legitimate marketing companies that really = do believe in the power of e-mail advertising, and are willing to play by= the rules — as soon as someone establishes some.
Big corporations and e-mail providers like Microsoft and America Online, which can’t help but suffer from schizophrenia on the spam issue. On the one hand, spammers annoy their customers and cost them money in bandwidth. On the other hand, none of them are willing to support legislative action that might someday limit their ability to make money by e-mailing their customers
Legislators, who see in spam a grass-roots = issue that is starting to resonate with voters, and yet can’t quite fi= gure out how U.S. laws can effectively regulate an international Internet issue.

&nbs= p;

In this s= pecial report, MSNBC.com will chronicle some of the bitter electronic warfare that’s currently taking place in cyberspace among this cast of characters. The package will also examine the economics that prime the spam economy, revealing some beneficiaries of spam that might surprise you. It w= ill introduce readers to the most important cast of characters in the spam worl= d, a Top 10 list of sorts, who are ultimately behind most of the unsolicited e-m= ail that currently clogs in-boxes. It will uncover some of the games spammers p= lay and the technology tricks they use to continually punch new holes in the da= m. Finally, it will examine the legislation that’s been designed to plug= the holes in that dam.

&nbs= p;

fact file<= /p>

What is spam?<= o:p>

Defining it

• What is spam

• Who sends it?

• What does it cost?

• Legal landscape

Fighting it

• Protect your address

• Diversify

• Read carefully

• Complain

What is spam?

Wh= ile most e-mail users think they know spam when they see it, it has proven surpris= ingly difficult to define. Some of the most-common definitions being bandied ab= out in connection with plans to regulate spam are: unsolicited commercial e-m= ail (UCE), which excludes unsolicited political messages and possibly outright fraudulent ones; unsolicited bulk e-mail (UBE); unsolicited commercial bu= lk e-mail (UCBE); and unsolicited electronic mail solicitations (UEMS), which would include even single unsolicited e-mails. Many e-mail marketers pref= er a definition that would require unsolicited messages to be fraudulent, deceptive or objectionable before they would be considered spam.

Who sends it?

The spammers who flood your inbox on a daily basis are most likely members of= a relatively small, shadowy group of pros capable of generating hundreds of millions of e-mails each day and using high-tech evasive tactics to avoid detection. Together, these big operators send the vast majority of unwant= ed e-mail. But they don’t work for free, and a wide variety of small-t= ime crooks, inventors and even major U.S. companies may ultimately be behind = the campaigns.

What does it cost?

Ea= ch year spam costs each U.S. end user between $30 and $50 and companies $730 in l= ost productivity for every employee with e-mail, according to the Anti Spam Research Group.

Legal landscape

Ch= eck the law in your state and the status of efforts to pass federal legislation a= t spamlaws.com.

Protect your address

Mo= st spammers build e-mail lists by harvesting from Web pages and Usenet postings. So a= void putting your e-mail address on your Web page. If you feel you must, one helpful trick is to encode your e-mail address using HTML characters rath= er than simple text.

Diversify <= /u>

Use multiple e-mail addresses, and save one for filling out Web forms and submitting to companies. That will keep spam out of your primary e-mail.<= o:p>

Read carefully

Re= ad online forms and software registrations carefully. Be sure to "opt-out" at every chance, letting companies know you don't want them sharing your e-mail.

Complain

No= t enough individuals go to the trouble of figuring out who's really behind the spa= m. Reading e-mail headers isn't as hard as it sounds -- click here for = a good primer.

Ge= nerally, once you learn the actual sender's domain name, an e-mail to abuse@domain= .com will do the trick. If it doesn't, here's a link to a site with more details on finding the right e-mail address for complaints:

Part 2:

IN THE TRENCHES OF THE SPAM WARS<= /o:p>

Conflict not for faint-hearted, say e-mailers, anti= -spam activists

http://www.ms= nbc.com/news/945559.asp?0cb=3D-215171549

By Mike Brunker

MSNBC

Aug. 7 — Spam is an ever-incre= asing annoyance for consumers, but it is far more than that for those serving on = the front lines of the bruising battle over junk e-mail and — some would = say — the future of the Internet. For them, it also is the root of the hardball legal tactics, hacking, harassment and death threats that are the hazards of their chosen vocation.

AT THE HE= ART of the fight lies a deceptively simple two-part question: How much — if = any — junk e-mail should Internet users have to tolerate in their in-boxes and how can the flow be controlled?

&nbs= p;

But with = the rising tide of spam — or unsolicited commercial bulk e-mail, as it’s more accurately known — the search for a middle ground bet= ween “none” and “as much as we care to send” is growing = ever more difficult.

&nbs= p;

“An absolutely guaranteed way to create an irreconcilable conflict is to have t= wo different groups of people with conflicting memories of the good old days,” is how John Levine, a board member of the Coalition Against Unsolicited Commercial E-Mail and operator of the spam-reporting service abuse.net, sums up the dispute.

&nbs= p;

STA= RKLY DIVERGENT VIEWS

&nbs= p;

“In= this case, you have the marketers’ good old days, when they could send mai= l to anyone they wanted, and the online community’s good old days on Arpan= et, when you couldn’t send any commerci= al e-mail,” said Levine, who also is the author of “The Internet f= or Dummies.”

&nbs= p;

The level= of hostility — high to begin with — has escalated with the adoptio= n of increasingly sophisticated tactics by nefarious spammers, including the use= of hijacked computers to send spam and identity theft to evade detection.

&nbs= p;

Such acti= ons have hardened the zero-tolerance attitude of some in the anti-spam community and fueled the development of what is considered by some to be the online equivalent of a weapon of mass destruction — the anonymously run SPEWS (Spam Prevention Early Warning System).

&nbs= p;

SPEWS lis= ts swaths of Internet real estate (IP addresses) that are known to be sources = of spam, belong to spam-friendly Internet service providers or host Web sites advertised in spam. The list is used by some ISPs and network administrator= s to block e-mail from would-be spammers before it is sent, which sometimes resu= lts in “inadvertent blocking” of messages from Internet users and I= SPs that have nothing to do with spam.

&nbs= p;

= 216;VIGILANTES OF THE INTERNET’

&nbs= p;

“Th= e people who are blacklisting ... are enacting their own revenge against people they decide on their own are guilty of spamming,” said Mark Felstein, a Florida attorney who is suing the unident= ified operators of SPEWS for allegedly damaging his also unidentified clients. “They’re the vigilantes of the Internet.”

&nbs= p;

It is aga= inst this backdrop of hostility and distrust that the virtual combat unfolds each day, as enemies assume their posts at computers around the world and launch rapid-strike ad campaigns and real-time counteroffensives. The fighting intensifies by night, when the roughly 200 big-time spammers said to be responsible for 90 percent of the world’s junk e-mail, often working together in loosely grouped “spam gangs,” send their junk e-mail flying around the globe in numbers that would make a Pentagon accountant blanch.

&nbs= p;

The battl= efield is vast, confusing and rapidly changing, as spammers shift the locations fr= om which they are carrying out their bombardments in order to foil efforts to trace them. This, in turn, triggers repeated scrambles among the trackers to find, filter and report the new spam in hopes of getting ISPs to quickly ki= ck the spammers off their networks.

&nbs= p;

It is dif= ficult to tell the players without a scorecard, as many are not who they appear to= be.

&nbs= p;

Virtually= every spammer claims to be a legitimate e-mail marketer who only sends ads to customers who have “opted in,” or agreed to receive them. But s= ome who swear they follow such business practices are criminals and cons who use every ruse available — both technical and rhetorical — to misle= ad and obfuscate their true activities.

&nbs= p;

WHO= ’S TELLING THE TRUTH?

&nbs= p;

The difficulty in determing who is telling the truth and who isn’t is clearly illustrated by Scott Richter, 31, who ran bars and restaurants and managed real estate before jumping into direct marketing four years ago.

&nbs= p;

Richter t= old MSNBC.com that his Colorado company, OptInRealBig.com, is frequently added = to blacklists and other spam registries “not because we do anything wron= g, but because the vigilantes have their own personal agenda against commercial e-mail.”

&nbs= p;

But Spamh= aus.org, which maintains the Registry Of Known Spam Opera= tions (ROKSO), a ledger of world’s most prodigious spammers, says that Rich= ter is a “long-term professional ‘porn and pills’ spammer who operates opt-out spamming under the guise of opt-in.”

&nbs= p;

Ronnie Scelson, a 30-year-old resident of Slidell, La., know= n as the “Cajun Spammer,” is one of the few practitioners of the secretive trade to acknowledge that he uses a variety of dodgy techniques to get his spam out, but maintains that he does so because anti-spammers have forced him to take such steps so he can remain in business.

&nbs= p;

Long cons= idered one of the world’s biggest spammers but currently in the midst of bankruptcy proceedings, Scelson said he views h= is battle with the anti-spam forces as a defense of the principles of freedom = and the American dream and vows to continue speaking out no matter what the cos= t.

&nbs= p;

= 216;I’M WILLING TO DIE’

&nbs= p;

“I&= #8217;m willing to die for what I believe in,” he said. “Look at Martin Luther King (Jr.). When they assassinated him, that’s when everything changed.”

&nbs= p;

Others ta= ke a calmer view of the struggle, as they try to make a living either by e-maili= ng ads for products and services to consumers or by devising ways to stem or eliminate the rising tide of spam.

&nbs= p;

Mary Youn= gblood, 34, head of Earthlink’s abuse team, said = she is able to put her training as a suicide prevention counselor to good use in talking to people who have had their accounts canceled for violating the ISP’s terms of service.

&nbs= p;

“Ha= ving that training helps me to appraise situations and not to start ticking off people before I know what’s going on,” she said.

&nbs= p;

Youngbloo= d also said that while she loves the thrill of the chase — she and her team conducted the investigation that led to the indictment of “Buffalo spammer” Howard Carmack — she doesn’t go home angry.

&nbs= p;

“I don’t take it personal,” she said. “I don’t get outraged and upset, but it’s a sort of a game that I want to win and I play hard.”

&nbs= p;

HAC= KERS COUNTERATTACK

&nbs= p;

It is muc= h harder to maintain an even keel, however, when faced with the kind of abuse that members of both camps say they are subjected to on a more or less regular basis.

&nbs= p;

Julian Haight, 32, owner of Seattle-based SpamCop.net, had h= is resolve tested this summer when he spent many weeks fending off denial-of-service attacks aimed at crippling his Web site, which helps people trace and report the source of unwanted e-mail and — for a fee — download spam-filtering softw= are.

&nbs= p;

One of the attacks is the result of what Haight described = as a “trojan” virus that, when it is unwittingly installed on other computers by users who open the file, launch= es attacks against the SpamCop Domain Name Server.=

&nbs= p;

“As= long as that code is floating around out there, it’s going to keep attacking,” he said, adding that the virus apparently was circulated through spam.

&nbs= p;

Briton St= eve Linford, the 45-year-old founder of Spamhaus.org and = keeper of the ROKSO registry of notorious spammers, said that he is regularly thre= atened with another form of “mail bombing” — the kind that explo= de in your hands when you open them.

&nbs= p;

= 216;PROFESSIONAL SCUMBAGS’

&nbs= p;

“Th= ey are so brazen that they’ll issue a death threat against you using their o= wn e-mail address,” he said of the “professional scumbags” w= ho end up on ROKSO.

&nbs= p;

Those on = the other side of the fence say the retribution flows both ways.

&nbs= p;

Cal Smith= , a 73-year-old Canadian who lists his occupation as “spam teacher”= and claims to help “little people, old ladies on the web who are trying to supplement their income because they can’t make it on their pension,” said he turned to teaching the techniques of mass e-mailing because it was safer.

&nbs= p;

“As= soon as I learned how to do it, then I started to teach it … because spam is dangerous,” he said. “It’s like walking along the street = by a 7-Eleven in a ghetto. You’re going to get mugged all the time.”=

&nbs= p;

Smith and= other e-mailers who say they follow the rules set forth in a confusing patchwork = of state spam laws complain that many anti-spammers make no distinction between law-abiding e-mail marketers and the notorious spammers who attempt to hide their identities and frequently market fraudulent products.

&nbs= p;

ANT= I-COMMERCE ‘HATE GROUPS’

&nbs= p;

“I have a beef against what I = consider hate groups that are trying to shut down commercial e-mail,” said Lau= ra Betterly, 41, the president of Data Resource Consulti= ng Inc., who said she was threatened and harassed after being dubbed the “Spam Queen” in an article last November in the Wall Street Journal.

&nbs= p;

In additi= on to the usual “I know where you live” threats and unwanted magazine= and catalogue subscriptions, she said she was awakened early one Sunday morning= by a phone call from an emergency help line manned by a volunteer at a national = bed wetting association.

&nbs= p;

“Ob= viously there are a lot of people out there with a lot of time on their hands,̶= 1; she said. “It’s shocking because I could be highly emotional ab= out 9/11 and teenage pregnancy but, at the end of the day, we’re talking about e-mail.”

&nbs= p;

Such comp= laints draw little sympathy in the anti-spam community, even among those who calls such abuse counterproductive.

&nbs= p;

“Th= ey’ve poisoned the village well and now the villagers have gotten out their pitchforks, and deservedly so,” said Neil Schwartzman, head of CAUCE Canada and publisher of “Pete Moss’ SpamNe= ws.”

&nbs= p;

RUT= HLESS RETRIBUTION<= o:p>

&nbs= p;

While muc= h of the abuse heaped on spammers amounts to teenage pranks, the vengeance occasiona= lly can be criminal and cruel.

&nbs= p;

Consider = the case of Rodona Garst, a Clarksville, Tenn., spammer who allegedly had the misfortune to forge the domain of a network overseen by an administrator with the wherewithal to mo= unt a forceful response. The administrator, who created a Web site detailing the case, said the forgery on a series of e-mailings to make it look as if they originated on his network resulted in “thousands of undeliverable ema= ils flying back at my mail server.”

&nbs= p;

The administrator, who identifies himself on the Web site only as “Man In The Wilderness,” claimed he set a trap for Garst that enabled him to hack into her computer and = those of numerous associates and download 100 megabytes of data. The assembled evidence made it clear, he said, that Garst and her company, Premier Services Inc., stole e= -mail addresses and passwords from gullible AOL users for use in sending spam, to= uted stocks in violation of Securities and Exchange Commission rules and spammed= a wide variety of products, including pornography sites.

&nbs= p;

To exact a measure of revenge, “Man In The Wilderness” posted the download= ed information on the Web site, including instant message logs detailing conversations among the spammers and, under the heading “Let’s = Get Brutal,” partially nude photos of Garst t= hat he said were found on her hard drive.

&nbs= p;

Some of t= he allegations on the Web site are unproven. But the SEC, in a settlement of a complaint against Garst in December 2002, verif= ied many details of the “pump-and-dump” stock scam and ordered her = to pay the government $15,673 — the amount she realized from stock sales= and fees she earned for fraudulently touting four stocks in her e-mail campaign= s.

&nbs= p;

STO= CK SPAMMERS EXECUTED

&nbs= p;

While Garst lost her privacy and her ill-gotten gains, spam= mers Alain Chalem and Mayir Lehmann may have paid the ultimate price for their stock-touting activities= .

&nbs= p;

Chalem, 41, and Lehmann, 37, were found sh= ot to death on Oct. 27, 1999, in the Colt’s Neck, N.J., estate that Chalem shared with his girlfriend and her 13-year-old= son. Chalem had been shot in the chest and five times in t= he head; Lehmann was shot in the leg and once in the back of the head.

&nbs= p;

Sgt. Joe Whitehead of the Colt’s Neck Police Department declined to say whethe= r the execution-style killings are believed to be linked to the men’s stock spamming activities, saying only that the case remains under investigation.=

&nbs= p;

While suc= h a connection remains unclear, Schwartzman, the Canadian anti-spammer, said the manner of the killings suggests the involvement of organized crime in the s= tock scam and underscores the rising stakes and emotions in the spam battle.

&nbs= p;

“If they’re killing their own, it’s only a matter of time before somebody in the anti-spam community gets killed,” he said.

&nbs= p;

Schwartzm= an said the Federal Trade Commission, which hosted a recent workshop on spam, took = the level of animosity into account in preparing a list of speakers that did not include “frothing-at-the-mouth militants” from either side of t= he fence.

&nbs= p;

NO ‘SETTLERS,’ ‘SUICIDE BOMBERS’

&nbs= p;

Comparing= the volatility of such a gathering to peace talks in the Israeli-Palestinian dispute, he quipped, “When you’re searching for common ground, = you don’t invite the settlers and you don’t invite the suicide bomb= ers.”

&nbs= p;

Despite a= ttempts to focus the debate, the three-day FTC workshop did not break any new groun= d. Participants were unable to agree on a definition of spam, with some in the marketing community saying the term should be applied only to fraudulently = sent e-mail or advertisements for bogus products and voices from the other end of the spectrum saying it should apply to any commercial e-mail not specifical= ly authorized by the recipient.

&nbs= p;

The prese= ntations by 87 panelists also underlined the widely held view that there is “no silver bullet” to solve the spam problem, as FTC officials told Congr= ess several weeks later. Instead, it will take a combination of legislation, law enforcement, technology and consumer action to prevent e-mail from being re= ndered useless to both individuals and businesses, they said.

&nbs= p;

In fact, = the workshop’s biggest contribution may have been bringing longtime foes = face to face, said Richter, the Colorado e-mailer.

&nbs= p;

“It= gave people a chance to see us in a different light … and realize that we’re not hiding behind closed doors,” he said. “You can = find us. We’re in the phone book and we’re visible.”

&nbs= p;

But SpamCop’s Haight sa= id the forum only underlined his sense of foreboding.

&nbs= p;

“The spammers are winning in that the legitimate use of e-mail is in decline,= 221; he said. “It’s sort of like the loss of innocence of e-mail. And it’s going to get worse. I think it’s going to get to the point where you can’t send someone an e-mail unless you call them on the ph= one first and tell them it’s coming. A lot of = people are at that point already.”

Part 3:

WHO PROFITS FROM SPAM? SURPRISE

Many companies with names you know are benefitting

http://www.ms= nbc.com/news/940490.asp?0cb=3D-315171549

= ;

By Bob Sullivan<= /o:p>

MSNBC

Aug. 8 — There wouldn’t be spam if = there wasn’t money in spam. So to understand what primes the spam economy, MSNBC.com answered a single unsolicited commercial e-mail. Following this o= ne spam trail led us from Alabama to Argentina, from a tiny Birmingham-based f= irm and someone named “Erp” past a noto= rious spammer named Super-Zonda — and right thr= ough big-name companies like Ameriquest, Quicken Loa= ns, and LoanWeb. And that’s just the beginnin= g. The truth about spam is this: While the dirty work is done by secretive, facele= ss computer jockeys who are constantly evading authorities, lots of companies = with names you know profit, at least tangentially, from their efforts.

&nbs= p;

“DO= N’T MISS THE lowest mortgage rates in history!” screamed the e-mail, which urged recipients to visit a Web site to ask for more information on a new h= ome loan. It claimed to be from “Gay Helms,” but the e-mail address looked fishy — m58ycxx@yahoo.ca. Its e-mail headers revealed the note started its life, not in Canada, as the e-mail address suggests, but in Argentina, sent from telecom.net.ar. That’= ;s a sure sign of spam. And, for good measure, it included an infographic on mortgage rates stolen from MSNBC.com.

&nbs= p;

Later, wi= th the help of spam-fighting firm Message Labs Inc., we would learn that e-mail headers in the note indicate it was sent from an IP address range known to = be used by Juan Garavaglia, also known as “S= uper-Zonda.” Garavaglia = is believed to send out some 30 to 40 million spam = each day.

&nbs= p;

But we st= arted with just one.

&nbs= p;

We clicke= d on the link and were transported to a Web page at LWSMortgage.com, where we filled= out the form with traceable, fake information and waited to see what happened to our data.

&nbs= p;

Four days= later, four companies sent us an e-mail indicating they knew we were looking for a= new mortgage: Ameriquest, Quicken Loans, LoanWeb, and Ivy Mortgage, a small mortgage broker ba= sed in North Huntingdon, Penn.

&nbs= p;

But none = of those companies sent the spam. So how did they get our information?

&nbs= p;

One of tw= o ways: They either bought it through third party companies called “lead generators,” or paid third-party contractors called “affiliates.”

&nbs= p;

LEAD GENERATORS

&nbs= p;

Lead gene= rators are behind-the-scenes Internet companies that get lists of consumers they s= ay are interested in a new mortgage. For each neat package of data provided to= a mortgage company, which includes name, phone number, address, amount of loan desired, current home value, and other information, lead generators earn ab= out $20. That’s a small price to pay for a potential $1,000 profit off a = new loan, said Ivy Mortgage branch office manager Brian Jo= len, who couldn’t track our data precisely, but said his company does buy = from lead generators. “Actually, it does work.”

&nbs= p;

And it wo= rks for spammers, too, who basically split the profits with lead generation compani= es. It’s the ideal spam business, said one former spammer who requested t= hat his name be withheld. Retail sales through spam, like hawking Viagra and getting tiny per-purchase payments, are hard work. But convincing a consume= r to simply fill out a form is much easier.

&nbs= p;

“Wh= at always seems to sell well and will always, I know it sounds stupid, are loan leads. People respond to that. They say, ‘What the hell,’ ̶= 1; the former spammer said. “I got $10 to $12 per lead. That’s good.”

&nbs= p;

The proce= ss also creates plenty of distance between the mortgage companies and the spammers.= In their initial e-mails, all four mortgage firms were generally vague about h= ow they got our information.

&nbs= p;

“I = was notified by one of our vendors, probably off the Web, that you would like information regarding a home loan,” wrote an Ame= riquest representative.

&nbs= p;

Quicken L= oans was more specific, but inaccurate.

&nbs= p;

“Th= ank you for requesting more information from Quicken Loans through our Web site,= 221; the firm’s note said.

&nbs= p;

ZER= O-TOLERANCE POLICIES

&= nbsp;

Quicken L= oans, Ameriquest, and LoanWeb a= ll said they do not tolerate spam, and indicated they would research the incident a= nd take action against whomever was responsible. Bu= t only Quicken Loans revealed exactly where it had purchased our information.=

&nbs= p;

It came f= rom Mleads.com, a mortgage lead generation company.

&nbs= p;

Mleads attorney Derek Newman said the firm doesn’t tolerate spam, and is “careful about policing affiliates.” Indeed, after a little research, Newman was able to fill= out the picture of our spam’s history, and he said the offending affiliate was immediately canned.

&nbs= p;

Newman sa= id the initial mortgage lead was generated by an affiliate of an affiliate of Mleads, a Birmingham, Ala., company named IC Marketin= g and a man who goes by the name “Erp.” <= o:p>

&nbs= p;

After IC Marketing received our data, it sold our information to a firm named Infoclear Marketing in Dallas, which then sold it to = Mleads, which in turn sold it to Quicken Loans, accor= ding to Newman.

&nbs= p;

Infoclear immediately terminated its contract= with IC Marketing when it heard about the spam offense, said Patrick Thurmond, w= ho identified himself as a founder of Infoclear. Thurmond says such multiple layers of resale are common in the lead busines= s.

&nbs= p;

CAN= ’T TELL WHO’S LYING=

&= nbsp;

“We= had one case last year that went back 15 layers,” he said. “You donR= 17;t know who’s lying to you and who’s not.”=

&nbs= p;

“Erp” — who refused to provide his real na= me — said he didn’t sell our information directly to Infoclear. Instead, he actually sold our data to a man named Rich Nolan, who operates Yourleadsource.com in Colorado Springs, and Nolan sold it to Infoclear. Nolan confirmed the assertion in an interview.

&nbs= p;

But Erp said he wasn’t responsible for the original e-mail, either. He said he bought it from someone else, who in turn bought = it from someone else, who in turn bought it from an e-mailer based in China. He didn’t provide contact information for those layers.

&nbs= p;

IC Market= ing doesn’t send out spam, Erp insisted — his firm me= rely resells mortgage leads, gleaning 25 cent or 50 cent profits for each lead s= ent up the food chain.

&nbs= p;

Such is t= he messy world of affiliate marketing. Jeff Hain, direct= or of marketing for LoanWeb, blamed his firm’s involvement in the spam on an affiliate who acted outside the company’= ;s policies. The Internet is full of such arrangements, first popularized by Amazon.com years ago. Small Web sites that push traffic and business toward= a larger firm get a small slice of the profits. It is often tempting for affiliates to send out spam to create such profitable traffic.

&nbs= p;

“We= have thousands of affiliates out there,” Hain = said. “When we get complaints, we ask the list owner to provide us with an audit trail,” including the date and time the e-mail recipient signed= up with an opt-in list.

&nbs= p;

SYS= TEM RELIES ON COMPLAINTS

&nbs= p;

But a sys= tem that relies on complaints only works when consumers doggedly hunt down spammers — and their beneficiaries. Few consumers would go to the trouble of creating a fake persona to track down the true benefactor of a spam message. Barring that, the affiliate can get away with it.

&nbs= p;

In fact, = despite all the noise about spam, actual consumer complaints are rare, says Jim Gregory, who managed spam abuse issues for Internet service provider Slingshot.com.

&nbs= p;

“We= had one guy sending out 1 or 2 million spam a day, and we’d only get 40 or 50 complaints,” he said. And that’s just a complaint about the spam e-mail itself — which would never make it to the legitimate commercial company like LoanWeb, the ultimate beneficiary.=

&nbs= p;

Mortgage companies are hardly alone in the murky world of the spam economy. Such out-of-control affiliates are frequently used to deflect criticism against = all kinds of unsolicited e-mails.

&nbs= p;

BLA= ME THE CONSUMER

&= nbsp;

Another p= opular deflection tactic — blame the e-mail consu= mer.

&nbs= p;

When e-ma= il recipients call a retailer to complain, the usual reply is, “you must have joined a mailing list for one of our partners at some point.” Ag= ain, dogged patience is required to insist that the firm provide an “audit trail,” which shows exactly when that e-mail address was subscribed t= o a list.

&nbs= p;

That was = MSNBC.com’s experience with Kraft’s Gevalia Kaffe, one of the= most popular retail e-mail commercials in circulation today. Gevalia is subscription-based coffee product sold by Kraft on a Web site, Gevalia.c= om. Spam abuse mailing lists are full of complaints about e-mails urging people= to try the luxury European coffee, which includes an offer for a free coffee maker.

&nbs= p;

The e-mai= l offers arrive many times each day at MSNBC.com. After about a month’s worth = of requests for information, Kraft still hadn’t produced an audit trail = for the e-mail. But it did say it works hard to prevent its affiliates from sen= ding out spam.

&nbs= p;

Through a= n e-mail interview, company spokesperson Abbe Serphos said, “Gevalia has no tolerance policy regarding SPAM, and we have strict policies in place th= at govern our e-mail communications to consumers.” Some affiliates have = been dropped for breaking those rules, she said, but she wouldn’t elaborat= e.

&nbs= p;

A C= LASSIC EXAMPLE=

&nbs= p;

Spam figh= ter Laura Atkins, president of the SpamCon Foundati= on, said Kraft is a classic example of a company that is quietly benefiting from spam, and not doing nearly enough to reel in spamming affiliates.

&nbs= p;

“Th= ey are violating California state law and they don’t care,” she said.<= o:p>

&nbs= p;

There is = only one effective way to stop out-of-control affiliates, said Dan Clements, who once operated an Internet advertising network that had several run-ins with affiliate spammers: Legal action against companies that benefit.=

&nbs= p;

“Th= e way to stop the spam is to subpoena the beneficiary site,” Clements, who now runs credit card fraud prevention site CardCops.= com, said. He actually received such a subpoena once, and said when he was force= d to give up contact information and bank account information about his affiliat= es, “They scattered like rats.”

&nbs= p;

ISP= S MAKE MONEY, TOO

&nbs= p;

An entire= ly separate set of companies also benefits from the spam economy — Inter= net service providers who carry their traffic.

&nbs= p;

Well-know= n spam nemesis Ron Scelson filed for bankruptcy earlie= r this year, and a review of bankruptcy documents shows he owes Bell South $56,463= for “circuits” and Cable & Wireless another $4,407 as his “Internet provider.” Neither company responded to requests for information about the bills.

&nbs= p;

But it= 217;s hardly the first time a big-name Internet provider has been caught in a deal with a spammer. In an embarrassing incident for both AT&T and PSINet three years ago, both firms were caught as participants in secret “pink contracts” with spammers. Long suspected in the spam world, the revelations exposed pink contracts as sweetheart deals for the Internet firms, designed to protect spammers. ISPs= get premium, well above normal rates, to sell bandwidth to known spammers. In exchange, the ISP agrees to suffer more than normal complaint rates. In PSINet’s contract, revealed on News.com, the fi= rm received an upfront payment of $27,000 from Cajunnet, a marketing firm based in Slidell, La. In exchange, PS= INet agreed to permit Cajunnet to send unsolicited e= mail “in mass quantity” through PSINet’s<= /span> lines.

&nbs= p;

= 216;MANY MORE’ OUT THERE

&nbs= p;

No such embarrassing pink contracts have been disclosed since 2000, but many spam experts say they still exist — either formally or informally.

&nbs= p;

“Th= ere are many more rumored to be out there,” said Ray Everett-Church, chief privacy officer for ePrivacy Group. “Ther= e are companies that have had more than enough complaints about a current custome= r to know some are engaged in massive spamming and yet they remain connected for weeks and months at a time. ... It’s evident somebody is either not d= oing much research before they sign people up, or in the worst case, they are ju= st flat out ignoring complaints.”

&nbs= p;

3D"Text But the problem doesn’t have to be that sinister, said Gregory, the former ISP spam hunter. The problem is often just a question of resources, he said — ISPs have a much larger sales staff than network abuse staff. One m= ajor ISP often only had one staffer working in the spam complaint department, he said.

&nbs= p;

“Th= ey have to argue for resources all the time,” he said. By default, spammers c= an get away with it for weeks or months, he said.

&nbs= p;

The strug= gling economy, which has hit Internet service providers particularly hard, has tempted some ISPs to take the tainted money, Everett-Church said.

&nbs= p;

“Yo= u’ve got a lot of sales forces being approached by folks willing to pay a little extra for reliable connectivity, and looking the other way on contract provisions enforcing antispam rules to keep get= ting paid those premiums.”

&nbs= p;

Gustavo <= span class=3DSpellE>Monserrat, who fights spam at Argentina’s Telec= om — the ISP where the mortgage spam cited at the top of this story began its life — admitted as much in a post to the spam abuse Internet newsgroup in May.

&nbs= p;

QUI= CK RETURN<= /o:p>

&nbs= p;

“Ma= ny customers have been unplugged due to spam reasons and due to a system’= ;s issue some have rebought our services under dif= ferent names/credit cards/phones,” he wrote. In “one case, we actually separated a customer from our network but hours later our money-thirsty salesmen sold him the service again.”

&nbs= p;

In a foll= ow-up e-mail, Monserrat said his company has new proc= edures in place to stop spammers from re-upping with his ISP once they are disconnected.

&nbs= p;

But in a struggling economy, the premiums that spammers will pay can be hard to resi= st, said Spamhaus.org’s Steve Linford.

&nbs= p;

3D"Text “Most of the ISPs are good to their word and are fighting it very, very hard,R= 21; he said. “But as you get into the larger ISPs, especially those that = are in any form of financial difficulty, the engineers, abuse staff and technic= ians all want the spammers off the network, but you have the sales staff looking= at the money. … The engineers will be fighting internally with the sales managers, but of course the sales managers always win.”

&nbs= p;

So with m= oney always there to prime the system, spam won’t stop, said one small-time spammer MSNBC.com interviewed. In his mind, there is only one solution: Consumers have to simply stop answering spam, making it finally not worthy anyone’s while to send it.

&nbs= p;

“Th= e only thing that’s going to make spam go away is if people do not respond,” he said. “When e-mail first started, you could send o= ut 50,000 e-mails a day and make money. Now you have to invest a lot of money = and time, you get a return rate of less than one-tenth of one percent. One day = it will become so you can’t send enough to make any money. And that̵= 7;s the only thing that will stop spam.”

Part 4:

THE SECRET TRICKS THAT SPAMMERS USE

From ‘bullet-proof hosts’ to spam clubs, here’s a look

http://www.ms= nbc.com/news/940853.asp?0cb=3D-415171549

By Bob Sullivan<= /o:p>

MSNBC

Aug. 11 — Joe Stewart was poring over= the complex computer code of a widespread new virus named “SoBig,” wondering what it was really designed t= o do. Then it hit him. This was not your typical attention-getting nuisance. The virus, he says, was actually designed to hack into home users’ comput= ers and quietly use them to send out spam. In the secretive world of spammers, where dirty tricks are standard practice, this was the dirtiest trick yet.<= o:p>

SPAMMERS LIVE IN A CAT-AND-MOUSE world, where survival means staying one step ahead of the peo= ple and technology that are giving chase.

The game began simply= , long ago, with a single e-mailer sending out multiple messages from an account, which was shut down by the e-mail provider.

But the battle for sp= am is a war of escalation. To get their messages out, spammers have taken to more a= nd more unsavory tactics; they bounce their e-mails around the world, break in= to insecure university computers and launch spam campaigns from there, even st= eal long-distance telephone service to sneak onto dial-up Internet accounts.

As a countermeasure, = some in the anti-spam movement have taken to ignoring e-mail that comes from certain parts of the Internet, which foils most of the tactics described so far.

“You implement = one new technology hurdle, that slows them down for days or wee= ks, but they eventually adapt,” said Ray Everett-Church, chief privacy officer for ePrivacy Group.

A= nd now, this latest adaptation. The = worlds of computer virus writers and spammers have merged, says Stewart. Trojan ho= rses are being placed on home computers around the Internet, making them willing accomplices to spam campaigns. Hiding behind the IP address of a home compu= ter is nearly the perfect disguise.

“It makes it ve= ry hard to trace back to the spammer,” Stewart said.

SPAMMERS NOW HACKERS

Researchers say hundr= eds of thousands of vulnerable computers are being used to launch spam campaigns n= ow. In fact, 70 percent of all spam is now sent this way, according to anti-spam firm Message Labs Inc. — and perhaps 6 to 7 billion spam messages are routed through hacked home computers.

“A lot of ex-ha= ckers, the black hats, they go into spamming,” said computer security expert Joel de la Garza. “And they are making a lot of money from that.̶= 1;

For some, the tactic = is the stuff of science fiction. Earthlink spam fighte= r Mary Youngblood now spends a lot of her time calling innocent victims telling th= em their computer is being used for spam. Often, they just don’t believe her.

“Some people sa= y, ‘You’re insane. My machine is fine. I haven’t gotten any complaints,’” she said. “We get lots of ‘experts= 217; that swear up and down, ‘No, no, you are completely wrong.’ = 221;

MOST WORK AT HOME

Youngblood’s ab= use team of 12 is part of a close-knit network of spam fighters at all U.S. Internet service providers who play the cat in this contest. While hacking into vulnerable computers, called “open proxies,” is the latest tren= d in spam, it’s just one of the popular tools used by spammers to evade th= eir pursuers. The spammers’ world is a constant search for bandwidth that won’t get turned off, e-mail software that helps them hide, and compa= nies that really will pay them for selling Viagra or Iraqi Most Wanted cards or penis enhancement products.

But it’s not a = world of high-tech genius million-dollar computer systems. Most spammers work at hom= e, using jury-rigged networks and software they’ve cobbled together with help from other spammers they meet in secret “spam clubs.” On t= hese member-only Web sites, targeted address lists are shared, illicit bandwidth= is bought and sold, and bulk e-mail software is discussed. Much like the underground world of credit card thieves, it’s full of name-calling a= nd accusations, and a constant, desperate search for reliable bandwidth.<= /o:p>

10 MILLION A DAY

One former spammer interviewed under condition of anonymity by MSNBC.com said he simply had fo= ur computers and two cable modems in his operation. With that setup, he said, = he was able to send out 10 million e-mails a day.

“The computers = were running all day, 24 hours a day,” he said. “You need to send ab= out 500,000 an hour to make any money.”

In fact, some spammer= s have an even a simpler setup, which can be harder to track. When Earthlink sued to stop spammer Harold Carmack, he was jus= t connecting to their systems using old-fashioned dial-up accounts. Youngblood, who led = the investigation into Carmack, said dial-up lines = can be the hardest to trace. Newer circuits have caller-ID-like technology called = ANI that can reveal exactly where a local telephone call is placed when it dial= s a modem pool; older phone lines don’t. Carmack tried to evade Earthlink investigators by using= local dial-up numbers from around the country. But he stumbled onto enough ANI-enabled lines that Earthlink was able to hu= nt him down.

BULLET-PROOF HOSTS

Evading the hunt is t= he chief task for all spammers, and it’s harder than it sounds. Nearly all spam has two components — the initial e-mail, and a companion Web page. The e-mail drives traffic to the Web site, where spam recipients are asked to f= ill out a form or buy a product. Both components have to work; if either one is shut down, the spammer can’t get paid.

That’s why spam= mers pay hundreds, and sometimes thousands of dollars a month for what’s known= as “bullet-proof hosts.” Such Web providers, with names like “Steel-Space,” promise their sites won’t get pulled down, even in the face of a deluge of complaints. Commonly advertised around the Internet as “bulk e-mail friendly Web hosting services,” many c= laim to operate offshore, far from U.S. legal subpoena power and the e-mail complaints of an English-speaking audience.

But other spammers co= ntend that most of the dirty work is still done in the U.S. “There is no su= ch thing (as an offshore server),” wrote one. “Offshore servers is a polite way of saying vulnerable, technologically challe= nged servers.”

Of course, distributi= ng the spam e-mail itself is the first and most important step. For that, spammers turn to bulk e-mail software like Send-Safe, which allows them to fake the = name listed in the “from” line.

Most e-mail addresses= at this point come from e-mail harvesting programs, which search the Web like Googl= e, culling the millions of e-mail addresses listed on Web pages or in Newsgroup posts. Spam clubs offer e-mail lists, too — some even claim to be targeted. One club viewed by MSNBC.com promised regularly updated lists in categories as narrow as “actors and actresses.”

E-mail lists are for = sale, too: some sites promise to divulge as many as 30 million e-mail addresses f= or under $100.

And to streamline the= process further, spammers can pay someone else to do their dirty work. For about $3= 50, many sites claim to do the entire process for you, delivering 1 million e-m= ails to consumers they say have “opted in” and are looking for offer= s.

CONFUSION IS THE BEST TOOL=

But perhaps the most = powerful tool in the spammer’s arsenal is plausible deniability. Spam complain= ts are always met with a response that the consumer volunteered for e-mail off= ers at some point. Usually, a “marketing partner” or affiliate is blam= ed.

A former employee at = an e-mail marketing company that claims to engage in only = opt-in marketing campaigns revealed just how this works, under condition of anonym= ity.

When she worked there= , people were constantly added to “opt-in” li= sts whether they opted in or not, she said. Frequently, marketers approached her firm with e-mail lists and spam campaign e-mails. Her company never asked w= here the e-mail addresses came from; it certainly didn’t require proof that the consumer had “opted in.” When complaints came, they pinned = the problem on the partner. And remove requests were completely ignored, she sa= id.

“I checked myse= lf when I was working there to see how many people had my e-mail address. And I was= on 15 lists. And I had never signed up for anything. It was disgusting,”= she said. “They tell people they must have subscribed. But that’s j= ust not true.”

Part 5:

CONGRESS TARGETING OUTLAW SPAMMERS

But firms could still send unsolicited ads under top bills

http://www.ms= nbc.com/news/948022.asp?0cb=3D-515171549

By Mike Brunker

MSNBC

Aug. 12 — Intern= et users say they’re choking to death on spam, but they may not get much breathing room from legislation expected to be adopted by Congress this fal= l. In a test of how well commerce and communication can coexist, the lawmakers appear determined to pass a bill that will target the “bad actorsR= 21; of the junk e-mail world but do little to reduce unsolicited pitches from d= irect marketers and other businesses.

&nbs= p;

GIVEN THE= RISING level of public frustration over spam, both supporters and opponents of var= ious bills working their way through Congress say they expect lawmakers to pass = spam legislation this fall, after nearly four years of unsuccessfully grappling = with the issue.

&nbs= p;

But with = eight separate bills on the table, the exact formula by which the lawmakers will attempt to address what is by all accounts a highly complex problem remains very much in flux.

&nbs= p;

The leadi= ng bills at this point — known as the CAN Spam Act in the Senate and the RID S= pam Act in the House — are expected to undergo changes in the coming week= s as provisions of competing legislation are incorporated to broaden support. But sources familiar with the negotiations say that some aspects of the final product are becoming clear.

&nbs= p;

Both bill= s would prohibit the sending of e-mail that attempts to disguise its source or cont= ains deceptive subject lines and would require advertisers to include both an “opt out” mechanism and accurate contact information.

&nbs= p;

They also= would impose some new criminal and civil penalties on spammers who violate the law and allow Internet service providers — but not consumers — to s= ue those who don’t abide by the rules.

&nbs= p;

= 216;DO NOT E-MAIL’ LIST IN TROUBLE

&nbs= p;

Apparentl= y out of favor is an approach advocated by Sens. Charles Schumer, D-N.Y., and Mark Dayton, D-Minn.: crea= tion of a “do not e-mail” list similar to the “do not callR= 21; registry recently put in place by the Federal Trade Commission to enable ph= one customers to opt-out of telemarketing calls.

&nbs= p;

Oppositio= n from marketers and concerns voiced by the FTC and others that the list would fall into the hands of unscrupulous e-mail marketers apparently have doomed the concept, although Schumer is expected to make a final attempt to add it to = the Senate’s spam legislation.

&nbs= p;

The propo= sals for a “do not spam” list were the closest lawmakers came to the “opt-in” method favored by most anti-spam groups, which would require advertisers to get permission from consumers before sending them th= eir advertisements.

&nbs= p;

This is t= he approach adopted in July by the European Union, which instructed its 15 mem= ber states to adopt legislation banning the sending of spam without prior conse= nt by Oct. 31. Numerous European lawmakers have expressed concern that the pas= sage of legislation in the United States based on an “opt-out” model will render the European laws moot, since most of the spam that reaches Eur= ope originates in the United States.

&nbs= p;

A federal= spam law also would erase tougher anti-spam laws on the books in several of the = 35 states that have enacted spam legislation since Nevada became the first sta= te to take the plunge in July 1997, a key issue for commercial e-mailers.=

&nbs= p;

“Wi= th e-mail crossing state borders so readily and with organizations often unsure where the recipient resides, pre-emption of state laws becomes absolutely necessary,” said Al DiGuido, CEO of Bigfo= ot Interactive, which does “permission-based” e-mailing for 150 companies. “Without pre-emption, there simply is no easy way to uphol= d, react to or manage the proliferation of state-imposed legislation.” <= o:p>

But because the feder= al legislation apparently will be based on the “opt-out” model, wh= ich would require consumers to ask advertisers individually to remove them from their e-mail lists, anti-spam groups argue that it will actually increase t= he spam volume by sending businesses that have previously stayed on the sideli= nes stampeding to the Internet.

“There are tens= of millions of businesses that would like to advertise directly to consumers,” said Jason Catlett, president of Junkbusters.com, a New Jersey-based organization fighting the proliferation of what it calls “junk advertising.” “If you spent the best part of your w= orking day opting out from your spam, and you did it diligently for six months, you might reduce the amount of spam you get.”

‘POTENTIA= L 200 MILLION SPAMMERS’<= o:p>

David Sorkin, a law professor at the John Marshall School of Law and creator of the spamlaws.com Web site, echoes those fears.

&nbs= p;

“Th= e big concern I have is not about the 200 bad spammers now but the potential 200 million spammers,” he said.

&nbs= p;

But suppo= rters of the legislation taking shape on Capitol Hill — including direct marke= ters and big Internet service providers like AOL and Microsoft, owner of MSN = 212; say that a “significant reduction” in unsolicited commercial e-= mail can be achieved by going after the renegade spammers believed to be respons= ible for the vast majority of spam.

&nbs= p;

“Th= is bill gives power to consumers to say ‘no more’ and provides a multi-tiered, very aggressive enforcement structure to go after the worst actors,” said Carol Guthrie, a spokeswoman for Sen. Ron Wyden, D-Ore., co-author with Sen. Conrad Burns, R-Mont., of the CAN Spam Act. =

&nbs= p;

Supporter= s of the legislation acknowledge that a federal law alone won’t solve the spam problem. Also necessary, they say, will be a stepped-up enforcement effort, improved global cooperation and better filtering technology.

&nbs= p;

But Louis= Mastria, a spokesman for the Direct Marketing Associa= tion, which represents nearly 500 direct mailers and marketers and has thrown its support behind CAN Spam and the RID Spam bill, by Rep. Richard Burr, R-N.C., said anti-spammers are simply “trying to scare people” with the= ir predictions that the legislation will trigger a deluge of junk e-mail.

&nbs= p;

“Ma= rketers are going to be very sensitive to volume,” he said. “… Lo= sing a customer (by ignoring his or her wishes) is a horrible thing because it’s nearly impossible to get that customer back.” <= /span>

&nbs= p;

In additi= on to support from direct marketers, sources say the CAN Spam and RID Spam bills = have climbed to the top of the legislative pile thanks in part to support from s= ome of the leading e-mail providers, including AOL and Microsoft, which operates MSN, as well as Internet portal Yahoo, all of whom have complained loudly a= bout the financial toll that spam inflicts on their networks. (MSNBC is a joint venture of Microsoft and NBC.)

&nbs= p;

LAW= MUST ‘EMPHASIZE THE DISTINCTION’

&nbs= p;

Ira Rubin= stein, an associate general counsel for Microsoft, defended the company’s effor= ts to shape anti-spam laws as necessary to preserve the commercial promise of = the Internet.

&nbs= p;

“Fr= om a policy standpoint it is very important to emphasize the distinction between legitimate e-mail and what everyone would agree is a typical case of spam … and (to) propose legislative remedies that reinforce that distincti= on and restore confidence in the use of e-mail as legitimate communication by legitimate companies,” he said.

&nbs= p;

He added = that Congress can play an important role in reducing spam by cracking down on renegade spammers, but said it should not “burden all online commerce” by imposing onerous regulations and harsh penalties because filtering technology is rapidly returning control to consumers. =

&nbs= p;

Rubinstei= n said that Microsoft also favors creation of a self-regulated industry group that would offer commercial incentives for e-mailers who adopt and abide by “best practices” rules. The incentives for advertisers to participate in the monitored program would be the right to display a digital seal indicating that the sender is in compliance with the standards and “presumption of compliance,” which would require complaintants to meet a higher standard of evidence t= o show that a company had violated the rules, he said.

&nbs= p;

Sources a= t AOL, who briefed MSNBC.com on the company’s lobbying efforts on condition = of anonymity, said the company has not taken positions on specific bills, but = has urged Congress to take a two-pronged approach to spam by requiring an “opt-out” mechanism and clear identification of the source of t= he mail coupled with strong criminal and civil penalties for spammers who reso= rt to fraud, falsification of headers, hacking or other illicit methods to send their e-mail.

&nbs= p;

Like Micr= osoft, the company believes such measures will compliment improving filtering technology and put consumers back in control of their inboxes, the sources said.

&nbs= p;

Yahoo representatives did not return calls seeking comment.

&nbs= p;

UNI= NTENDED CONSEQUENCES FEARED

&nbs= p;

The ISPs&= #8217; position has support in some quarters without a direct stake in the outcome= .

&nbs= p;

Clyde Way= ne Crews Jr., director of technology policy at the Cato Institute, a libertarian-min= ded think tank, said he thinks that federal legislation could have unintended consequences if it isn’t carefully targeted.

&nbs= p;

“The Internet is already suffering and you have to be careful that you don’= ;t create a situation where the good guys get swept under and become terrified= to use the Internet,” Crews said.

&nbs= p;

But sever= al sources familiar with the Internet companies’ lobbying efforts told MSNBC.com that during discussions with lawmakers and their staff members, t= he firms’ representatives have appeared to be more focused on protecting= a potentially lucrative revenue stream rather than combating spam.

&nbs= p;

“On= e of the ironies of all this is that while the industry wants to reduce the amount of spam going through their networks, some of the bigger ISPs are opposing more stringent measures because they use spam to market their products,” s= aid one source, who like the others spoke on condition of anonymity. “They want a measure that directly impacts the rogue spammer, but doesn’t directly address the underlying issue.”

&nbs= p;

Another s= ource said the companies’ stance reflects a mistaken belief that the public is willing to accept advertisements for their products and services if the off= ers for body-enhancement products and pleas from Nigerian widows are excised fr= om their inboxes.

&nbs= p;

“Th= ey don’t recognize that their stuff is regarded by many people as spam,” the source said.

&nbs= p;

The big I= SPs have not marched in lockstep on spam legislation.

&nbs= p;

Earthlink, for example, indicated a willingne= ss to accept an opt-in standard.

&nbs= p;

“I = think from a consumer perspective, ‘opt in’ would be the ideal standa= rd because otherwise every online merchant gets at least one free spam, which would put a burden on consumers,” said Dave Baker, vice president of = law and public policy for Earthlink. “But as a practical matter, virtually every piece of legislation adopts an opt-out standard, so that appears to be the reality of what we’re dealing with.”

&nbs= p;

DEL= IVERY REQUIREMENT OPPOSED

&nbs= p;

However, = Earthlink is in agreement with AOL and Microsoft that= the law should not require ISPs to deliver commercial e-mail, even if the sende= rs comply with all the rules.

&nbs= p;

“Th= ere can be no restriction on an ISP’s current ability to block spam on behalf= of its customers,” Baker said. “We’re not going to get into a situation where a direct marketer says to an ISP, ‘You have to delive= r my messages.’”

3D"Text

While muc= h of the maneuvering by stakeholders in the spam debate has quietly taken place in discussions with legislators and staffers, Microsoft suffered a public black eye this summer when a California lawmaker accused the company of killing w= hat would have been the country’s toughest anti-spam law.

&nbs= p;

The 5-2 v= ote by an Assembly committee to kill the bill by state Sen. Debra Bowen, D-Redondo Beach, came on July 1, the same day that Microsoft announced it was suing 15 spammers for allegedly abusing its network. Some observers saw the timing o= f the announcement as an effort by the company to divert attention from its role = in California.

&nbs= p;

In a stat= ement issued after the vote, Bowen ripped the Redmond, Wash.-based software manufacturer for lobbying against her bill, which was patterned after the f= ederal law banning unsolicited junk faxes.

&nbs= p;

“Mi= crosoft doesn’t want to ban spam; it wants to decide what’s ‘legitimate’ or ‘acceptable’ unsolicited commercial advertising so it can turn around and license those e-mail messages and cha= rge those advertisers a fee to wheel their spam into your e-mail inbox without = your permission,” she said.

&nbs= p;

Bowen told MSNBC.com that Microsoft was particularly concerned about a passage in the = bill that would have allowed consumers to sue advertisers who violated the law f= or $500 per spam - a penalty that could have been tripled by a judge if it was determined that the advertiser did so “willfully and knowingly.”= ;

&nbs= p;

“I = wanted to make sure we could go after the big spam houses,” she said. “… Microsoft said, ‘We want to make sure we don’t g= et caught up in the litigation.’”

&nbs= p;

RIV= AL BILL PREFERRED

&nbs= p;

Rubinstei= n, the Microsoft spokesman, said only that the company preferred a rival measure by state Sen. Kevin Murray, D-Los Angeles, over Bowen’s bill and made its reasons clear to legislators.

&nbs= p;

“In= many states, we’ve been applauded for our efforts; in others, we’ve = been subjected to political disagreements,” he said of Bowen’s comme= nts.

&nbs= p;

He also s= aid that, while Microsoft recognizes that emotions run high on spam, it doesn’t believe that the positions it has taken on legislation will trigger a public backlash against the company.

&nbs= p;

“If= there is an outpouring of anger, I don’t think it will be because of a stan= d we have taken on legislation,” Rubinstein said. “It will because t= he efforts now under way on legislation, enforcement, technology and self-enforcement have failed. … And then it will be deserved.”<= o:p>

The World’s Top Ten Spammers<= o:p>

Eddy Marin This Boca Raton, Fla= .-based e-mailer recently earned the title of “World’s No. 1 spammer” from Spamhaus, which says he is capable of cranking out 50 million e-mails a day by h= imself and 250 million a day if he farms work out to other members of his “spam gang” in south Florida. A Colombia born former Pompano Beach nightclub owner and online porn entrepreneur with cocaine dealing a= nd money laundering convictions on his record, Marin, 41, goes to considerab= le lengths to avoid unwanted intrusions on his privacy. He is only known to = have given one interview – to the Miami Herald in 2000, during his days = as a would-be porn kingpin – when he told the newspaper that he had downsized what was a struggling live Web cam site and was instead focusin= g on developing, hosting and doing marketing for other Web sites. Doing busine= ss as “Opt-In Services,” he told the newspaper at the time that = he had generated revenue of $750,000 during the first quarter of the year -- "over 80 percent profit" -- and indicated he was beginning to f= ocus on marketing data bases and "opt-in mailings." Marin was former= ly partnered with another notorious spammer, Thomas Cowles, but the two apparently had a falling out.
George Rand An exceptionally low= -profile fellow, even by spammer standards, Rand has registered two businesses in = New York but may reside or also do business in Miami. He has been known to sp= am a wide variety of products and services, including bogus penis-enlargement pills, anti-terrorism T-shirts, bad-credit repair and even inspirational = golf balls for Christian golfers, according to posts to anti-spam Usenet group= s.	[no photo available]
Alan Ralsky Ralsky, who is in his late 50s, has been among the nation’s biggest spammers since entering the business in 1997 while recovering from bankruptcy – one of nine filings dating back to 199= 3 -- and the loss of his insurance license. Previously, while living in Illino= is, he was convicted of felony fraud and “failing to deliver a contract” involving unregistered securities. R= alsky has boasted in various media interviews that he has the capability of sen= ding tens of thousands of e-mails an hour pitching such products and services = as mortgages, vacations, online pharmacies and casinos for clients, relayed through servers in the United States and abroad. He was sued in 2001 by Verizon in a landmark lawsuit seeking $37 million in damages for allegedly twice paralyzing the company’s network by sending bulk e-mail. In an October 2002 settlement, Ralsky agreed to pay= an undisclosed amount to the company and refrain from sending spam on any of Verizon's networks. After his address and photos of his new $740,000 home= in West Bloomfield, Mich., were published on the Web late last year, Ralsky was subjected to probably the biggest revenge mailing of the spam wars when anti-spam crusaders signed him up for every magazine, brochure, catalog and junk-mail offer available. "These pe= ople are out of their minds. They're harassing me," he told the Detroit N= ews in December.
John Ritzer John Ritzer Little is known abou= t this Anaheim, Calif.-based spammer, who also uses the nom de spam “Jack Ross,” except that he has been very busy for the past several years= . Ritzer, who does business through at least three en= tities – JR Marketing, M&J Marketing and National Mortgage Funding Inc= . -- is believed to be in his mid-30s. He is an associ= ate of No. 3 spammer Alan Ralsky (he has at times us= ed his servers to host Web sites and domains for Ralsky) and specializes in mortgage and loan pitches.	[no photo available]
Juan Garavaglia Garavaglia, who also goes by the name Al Vaglia, is an apparent newcomer to spamdom’s top tier, first appearing on the Spamhaus radar a= bout six months ago under the sobriquet “Super-Zond= a.” He also is believed to be the lone South American representative on the l= ist, working out of Buenos Aires. The reason for the uncertainty about Garavaglia’s whereabouts is that he is a mast= er at hiding his tracks and quickly shifting locations as he uses insecure computers to send e-mails and host Web sites. The British Broadcasting Co= rp. reported recently that “Super-ZondaR= 21; was able to use an insecure British Airways Web site to send out spam for= a Russian mail order bride site.	[no photo available]
Eric Reinertsen A longtime spammer f= rom Florida, which has emerged as the world capital for unsolicited commercial e-mail, Reinertsen has a host of domains set = up on servers far and wide to aid in his high-volume operation. Like many of the others on the Top 10 list, he also uses such illegal ploys as hijacking of mail-servers to further his ability to get out the junk mail. Best known = now for sending out investment “tip” e-mail, he recently caused a stir by allegedly sending spam on behalf of Fox Sports. In May 2001, he proclaimed in a news group posting that he had been wrongly accused of spamming, saying that the company name he was identified with at the time, datastreamgroup.com, had been victimized by a hacker who sent out e-mail “forged with our email address … (and) sent out from a prserv= .net dialup relayed through a Korean server. We have this matter under investigation with the authorities and various ISPs.”	[no photo available]
Mike Cunningham Working with associa= te Andrew Amend under the U.S. Health Laboratories aegis, Cunningham is a ma= jor source of e-mail offering cut-rate Viagra and offers covering “all kinds of medical quackery,” according to Spamh= aus’ Steve Linford. Operating out of Hayes, Kan., Cunningham and others created an ISP – Katelecom.com – in 200= 1 in order to hide from their provider, Sprint. The ruse worked for a while, as tens of thousands of spam complaints were sent to postmaster@katelecom.com rather than Sprint. Cunningham describes himself as a devout Christian and claims to have attended a Baptist college in Iowa, where he engaged in extensive studies of the New Testament. He also is or was a member of an obscure spiritual music-comedy act, “Hugh Myrr= and John Donut.” Cunningham also vowed in a posting to a message bo= ard used by spammers to defend his “God-given right to spam.”	[no photo available]
Gaven Stubberfield= Stubberfield is the leader of a group of spammers based in = the Raleigh, N.C., that specializes in e-mailings promoting porn sites, inclu= ding a particularly notorious piece offering a free video involving bestiality between a teenage farm girl and her horse. Until January 2003, when they apparently were sent packing by their ISP, Stubberfi= eld and friends had a high bandwidth T-1 line and multiple computers that pum= ped out spam around the clock. Stubberfield also = has dabbled in illegal pyramid e-mail scams and a purported “business opportunity” making money off unclaimed Federal Housing Administrat= ion homeowners’ insurance policies, both of which were vigorously promo= ted by spam.	[no photo available]
Carl Henderson Under the Ultimate H= ealth banner, Henderson spams a variety of fraudulent health products, including human growth hormone (HGH) and miracle weight-loss and breast-enlargement pills and creams. Henderson survives by being quick on his feet, changing domains quickly and using Chinese ISPs to advertise Web sites on pirated Chinese servers, including some belonging to elementary schools in China. Bogus contact information in “whoisR= 21; records points to many states, but some of his Web sites gave an address = in Madison, N.J., that may have been his base of operations at one time. Henderson either uses the alias “Harry A. Crea= ghan” at times or has a business associate by that name.	[no photo available]
DocDrugs/Pinnacle Meds This apparently Florida-based “spam gang,” which has so far managed to remain anonymous, controls an array of domains on which it hosts numerous mirror= ed online drugstores specializing in sexual-performance, weight-loss and oth= er health-related products. The “mother ship” of the drugstore s= uite is ultrameds.com, which has been hosted for long stretches by the Internet access company Ifxcorp, which does most of its business in South America. Although the spammers have been able to avoid detection, they haven’t been so diligent in protecting the identiti= es of their customers and affiliates, according to a Usenet posting last yea= r. The poster said that due to sloppy ASP coding, the group was exposing “customers’ credit and medical details to the world,” as well as the names and locations of some affiliates. The “whois” records for DocDr= ugs and related sites contain false contact information, but many of the reco= rds list addresses in Aventura, Fla., suggesting = this outfit may be based there.	[no photo available]