Home / Blogs

Spam Fighting: Lessons from Jack Bauer?

Terry Zink

As I blogged about several months ago, as did numerous other anti-spam bloggers, David Ritz was sued by Jeffrey Reynolds and a judge in North Dakota agreed with Reynolds. At the heart of the case was that Ritz engaged in anti-spam activities using techniques known only to a small subset of advanced computer users, and used these techniques maliciously against Reynolds.

A couple of years ago, I reviewed the book Spam Kings. Back in the olden days of spam fighting, some anti-spammers used to use malicious techniques against spammers in order to shut them down. Maybe they'd break into their web servers and disable them, maybe they'd flood the spammers' email addresses with unsolicited mail or cripple their operations with DOS attacks. Regardless, the point is that they would use illegal techniques to shut down spammers. The idea was to fight fire with fire. Spammers are annoying? Then you have to get your hands dirty to shut them down. Some people on anti-spam discussion forums cheered the moves; others said that spam fighters could not resort to the level of the spammers themselves.

Last night (Jan 11, 2009), I was watching the premiere of 24, Season 7. In the opening scenes, Jack Bauer is brought to Washington and is being interrogated by a Senate subcommittee on charges that he tortured various terror suspects and therefore broke United States law banning torture. Bauer even admits that he broke the Geneva Conventions. To escalate the tension, the Senator asks Bauer if he thinks he is above the law.

24 is all about drama. Bauer looks at the Senator, and says (and I paraphrase) "Don't give me that smug look. These people who try to attack us don't play by your rules. I did what I had to do in order to protect the people of this nation and I will answer to them." Bauer is quite unrepentant in his beliefs that while he did break the law, he did it to protect the citizens of the country and he does not apologize for it. Bauer gets results (the Senator did not watch the previous six seasons of the show).

Spam fighting would never be the focus of an episode of 24. It's not quite that glamorous. But the philosophical issues Bauer brings up are valid — if anti-spam fighters start engaging in dubious tactics to shut down nefarious spam operations, how apologetic should they be? Should they (we) even sink to a level of questionable ethics?

Let's say that a web site is discovered that is selling counterfeit pharmaceutical products, an activity that is quite illegal. Some hackers can take down the site in a matter of minutes using a DOS attack. Should we do it?

A spam operation is sending out stock spam, illegally pumping and dumping a penny stock traded on the pink sheets. An anti-spam operation can break into their servers used to send email and shut it down. Should we do it?

There are plenty of examples of spam, botnets and viruses used for illegal activity, from fake university degrees (fraud) to porn operations (exploiting underage children). In some of these cases, these types of activities can be reverse engineered and shut down. Obviously, by approaching the proper authorities, many of them can be deactivated. However, sometimes the proper authorities lack the knowledge or the willpower to stop supporting all of this stuff. The McColo incident is a prime example; if we knew for so long that McColo could have taken have the spam world off-line, why did it take so long? Could somebody just have gone and cut off the power to the building? Would that have been right or wrong?

It's a philosophical problem — how much are we willing to put up with when it comes to spam, and what levels should we sink to? And who should we answer to? The security industry? Or the end users we are acting in the name of to protect?

By Terry Zink, Program Manager. More blog posts from Terry Zink can also be read here.

Related topics: Cyberattack, Cybercrime, Email, Law, Policy & Regulation, Security, Spam

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:


As an example, how would know what Joe xx  –  Jan 12, 2009 5:21 PM PST

As an example, how would know what pharms are counterfiet?  Were tests run, do you have evidence, sworn statements?  Can you even specify the exact law that was broken?  But I am sure you "know" the answers to all these questions.  I am also sure Mr. Baeur "knows" every one of those people he discussed were "terrorists" ... I mean terrorist "suspects."

What it basically boils down to is that these people are above the law because they "know" what is right.

Please! Take it easy on shutting power Michael Roberts  –  Jan 12, 2009 8:11 PM PST

Please! Take it easy on shutting power to that data center, my server is in the building.

Please leave Ritz out of this John Levine  –  Jan 13, 2009 12:22 PM PST

Regardless of what you might think about vigilante anti-spam techniques, the Ritz case was a travesty of justice.  The "advanced" technique that the judge was bamboozled into interpreting as a malicious attack was an ordinary DNS zone transfer request, something that sys admins have routinely done for decades.

So what happened after he a zone Joe xx  –  Jan 13, 2009 3:10 PM PST

So what happened after he a zone transfer?  I am sure that was not the end of it or it would not be in court.

More on Ritz John Levine  –  Jan 13, 2009 3:15 PM PST

See this CircleID post from a year ago:


If you follow the link in the Joe xx  –  Jan 14, 2009 6:33 AM PST

If you follow the link in the post to the actual decision you can read the truth:


The truth is the court did not determine zone transfers to be illegal, it said using zone transfers and other methods to break into a private network is illegal.  A quote:

" The Court need not determine whether a normal, single DNS query is authorized within the meaning of the statute. Even if there had been any authorization for a such a DNS query or lookup, Ritz exceeded that authorization in violation of the statute by conducting a zone transfer and attempting further access."

This is similar to using burglary tools.  Courts don't say use of the tools themselves is a crime but using them to break into private property is.  The guy also violated a court order not to this.

This is not "anti-spam activities," this is hacking into a private network and committing computer crimes.

Really, leave Ritz out of it John Levine  –  Jan 14, 2009 7:04 AM PST

This is not "anti-spam activities," this is hacking into a private network and committing computer crimes.

Yes, that's the ridiculous misinterpretation of Ritz' perfectly normal actions that the court was bamboozled into accepting. The parties in this case both have long histories online, and if you look at the background of the case, it's crystal clear who is the good guy and who is the bad guy.  It is rare for a state court to get a case as wrong as this one did, but the actual facts speak for themselves.

To me anti-spam activities means complaining to Joe xx  –  Jan 14, 2009 9:24 AM PST

To me anti-spam activities means complaining to the provider, complaining to the business being advertised, complaining to law enforcement, or suing in court.

This guy made zone transfers in order to map the internal network and then he went and attacked the network using this information.  He used proxies to try to hide his identity and defied a court order.  If he had used the zone transfers and traceroutes merely to complain to the provider or collect evidence for court what he did seems perfectly fine.  However, the info was used to break into the network and that is what was deemed to be illegal.  This seems like the proper decision to me.

As for the spammer, this situation does not say one way or the other whether he is "good" or "bad."

What the antispammer should have done was collect the evidence and seek an injunction to shut the network down.  Instead, he took matters into his own hands.  Who knows what kind of trouble can be caused if people started running around doing this stuff on their own based on their own belief of who is "bad."

More lies about the Ritz case John Levine  –  Jan 14, 2009 9:43 AM PST

This guy made zone transfers in order to map the internal network and then he went and attacked the network using this information.  He used proxies to try to hide his identity and defied a court order.

David did do a routine zone transfer to try and identify the hosts that Reynolds was using to spew usenet spam, but he did none of the other things you accuse him of.  If he had not been near death in a coma in the hospital when Reynolds sued him, he'd have been able to respond more successfully.  Incidentally, Reynolds was the provider; his goal in his SLAPP suits has been to hide that fact.

I really wish you would inform yourself better rather than just parrot the false accusations in this case.  Also see

Not like you to reply to random anonymous trolls, John .. Suresh Ramasubramanian  –  Jan 17, 2009 7:24 AM PST

Wish circleid had a killfile.

finding of fact Joe xx  –  Jan 17, 2009 11:04 PM PST

I read from the finding of fact issued by the court but i am sure I can more information from a bunch of hysterical posts.  And I see everybody is a "troll" who points out facts.

Some notes Terry Zink  –  Jan 18, 2009 12:23 AM PST

When I alluded to the Ritz case, I was not implying I agreed with the ruling against him.  Rather, I was framing my post by loosely painting it against a backdrop of a real life situation.

To post comments, please login or create an account.

Related Blogs

Related News


Industry Updates – Sponsored Posts

Afilias Supports the CrypTech Project - Ambitious Hardware Encryption Effort to Protect User Privacy

IBCA Presentation to ICANN GAC on Protection of Geographic Names in New gTLDs

Public Sector Experiences Largest Increase in DDoS Attacks (Verisign's Q4 2014 DDoS Trends)

Help Ensure the Availability and Security of Your Enterprise DNS with Verisign Recursive DNS

Verisign iDefense 2015 Cyber-Threats and Trends

What's in Your Attack Surface?

Domain Name .Africa Faces Hurdles - Q&A with Sophia Bekele

Q3 2014 DDoS Trends: Attacks Exceeding 10 Gbps on the Rise

3 Questions to Ask Your DNS Host About DDoS

Afilias Partners With Internet Society to Sponsor Deploy360 ION Conference Series Through 2016

Neustar to Build Multiple Tbps DDoS Mitigation Platform

The Latest Internet Plague: Random Subdomain Attacks

Digging Deep Into DNS Data Discloses Damaging Domains

New gTLDs and Best Practices for Domain Management Policies (Video)

Nominum Announces Future Ready DNS

Non-English "IDN Email" Addresses Are Finally Working!

New from Verisign Labs - Measuring Privacy Disclosures in URL Query Strings

Video Interviews from ICANN 50 in London

DotConnectAfrica Delegates Attend the Kenya Internet Governance Forum

Neustar to Launch usTLD Stakeholder Council

Sponsored Topics



Sponsored by

DNS Security

Sponsored by
Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines


Sponsored by