Online Extra: Turning the Tide of Spam
The fight against big-time spammers is a tough one -- but sometimes the little guy can win.
Case in point: Tiny CIS Internet Services. Beginning in 2000, the Internet service provider (ISP) based in Clinton, Iowa, (population: 35,000) began to be deluged with tens of millions of spam e-mails. A CD-ROM popular among spammers had some 2.8 million e-mail addresses for real and bogus CIS clients. It included names likes email@example.com and firstname.lastname@example.org.
Trouble was, CIS only had 5,000 customers, mostly rural Iowa residents with dial-up service at the time. Its single T1 Internet connection couldn't handle the e-mail onslaught, which caused servers that should have run untroubled for months to crash frequently.
TURNING THE TABLES.
After battling with the junk e-mails for two years, CIS founder Robert Kramer, 46, decided to fight back. He contacted antispam attorneys Paul "Pete" Wellborn III and Kelly Wallace. The duo have helped giant Atlanta-based ISP EarthLink (ELNK ) track down and sue dozens of other online purveyors of Viagra and herbal supplements. One, Howard Carmack, known as the Buffalo Spammer, was convicted and sentenced to up to seven years in jail last year by a judge in Erie County, N.Y.
With Wallace taking the lead, the attorneys identified 300 "John Doe" spammers and filed suit in U.S. District court in Iowa in October, 2003. Like so many other executives at ISPs, Kramer has been troubled by spammers for years. More than 80% of e-mail is estimated to be spam, according to e-mail security firm Postini. Microsoft (MSFT ), Time Warner's (TWX ) AOL unit, and EarthLink have filed dozens of suits to shut them down.
Now, it was Kramer's time to turn the tables. "They're criminals all the way around," he says.
Victory, at least moral, came last December. Setting a financial precedent, a federal judge awarded $1.08 billion in damages to CIS, blaming three companies identified as using its servers to send unsolicited e-mail. None of the companies -- Florida-based Cash Link Systems and TEI Marketing, and Arizona-based AMP Dollar Savings -- ever responded to the court. It didn't matter. The judgment was the largest ever against spammers.
More important, it delivered a message that the veil of anonymity on the Web is lifting. "This is a stark reminder to spammers of the kind of punishment that can await them," says Ray Everett-Church, chief counsel at the Coalition Against Unsolicited Commercial Email (CAUCE), an antispam group.
Indeed, the CIS case shows how the law may finally be catching up with cybercriminals. CIS sued them using an Iowa antispam law that allows plaintiffs to claim damages of $10 per junk message -- a severe penalty for spammers pounding in-boxes with billions of e-mails each day. And they used the federal Racketeer Influenced & Corrupt Organizations (RICO) Act, which Justice Dept. officials say is proving to be a useful tool in charging alleged cybercrooks.
Indeed, in the ruling, U.S. District Judge Charles Wolle agreed that CIS was harmed by a spam deluge that methodically filtered more than 10 million messages per day through company servers. "There are people out there who think they're immune from prosecution," says Wallace, 34, who studied law at the Georgia Institute of Technology.
The evidence against the spammers in the CIS case was substantial, says Wallace. The companies allegedly used a CD-ROM called "BulkMail4Dummies, Version 2" to hawk cashless ATMs, mortgages, and Viagra. In court, Wallace showed log files indicating that each day between August and December, 2003, Cash Link Systems sent 60,000 spam e-mails to CIS customers, AMP sent 120,000, and TEI sent another 1,400. The actual numbers were much higher, says Wallace.
And those companies' alleged misdeeds were nothing compared to the firehouse of spam that CIS suffered. CIS server logs showed that in one 24-hour period, more than 9 million connection attempts were made to CIS servers by the three companies and dozens of others. Most were successful. Spam experts say there's no limit to the amount of e-mail that can be sent with each connection. And the wave of connections hit every day for years. "This was a constant attack," says Wallace.
Kramer is unlikely to see much of the money in the short run. Cash Link Systems, which owes $360 million, had its assets seized last year by the Securities & Exchange Commission. The feds accused the company of running a scam to lure investors for its cashless ATM business. Few of its ATMs were ever installed, according to an SEC complaint. AMP Dollar, tagged with a $720 million penalty, and TEI Marketing, which owes $140,000, have remained silent.
Since then, however, Wallace has filed another lawsuit on behalf of CIS against the alleged operators of AMP, the husband and wife team Henry Perez and Suzanne Bartok, seeking to collect damages. A judge declined their motion to dismiss the suit in March. The duo's attorney, Davis Foster, says the case is now moving to discovery. He disputes that AMP, itself, was a spamming company.
The pain of dealing with spam has eased only slightly for Kramer since the judgment. After all, the authors of "BulkMail4Dummies" have yet to be tracked down, despite an FBI investigation prompted by antispam attorneys Wellborn and Wallace. Kramer estimates he has spent more than $200,000 to repair equipment, upgrade servers, and add bandwidth to handle the continuing spam flood.
Despite having launched DSL and wireless broadband service, his customer base has tumbled below 5,000, smaller than it was before the lawsuit. Spammers still paste CIS e-mail addresses into their "From" fields to hide the origins of their wares. Those e-mails are bounced back to Kramer from AOL, EarthLink, and other giant ISPs, creating more spam. "These schmucks don't just blast you 3 million times then go away," he says. "They hit you again and again and again."
Still, Kramer holds out hope that one day he will be able to look a convicted spammer in the eye -- as he collects a huge check for damages. "I have worked my ass off, and they have dominated my life for many years," he says. "It would be nice to see what type of a person pushes a button and walks away." Meantime, he's savoring a small but symbolic victory against the spam set.
By Brian Grow in Atlanta
Edited by Patricia O'Connell