Home / Blogs

Spamming the News Cycle: Spamhaus Non-Story Goes Viral

Google News now shows more than 300 stories about Spamhaus, most about a proposed court order following a district court default judgment.

To me, the most interesting is the meta-story—why the non-event of a proposed order has the blogs scrambling with claims of constitutional crisis and even the notoriously close-lipped ICANN issuing an announcement “in response to community interest expressed on this topic.”

We’re seeing a clash of cultures between tech and law. The tech world, afraid the law will jump to erroneous conclusions and cripple an anti-spam mechanism, is in turn making some quick but wrong assumptions about the legal process. Happily, there’s enough play in both tech and legal systems to correct for both these errors.

On the legal side, we have a process that has so far aired only one side—because the other is challenging the court’s jurisdiction even to hear the case. Spamhaus, based in the U.K., runs widely-used SPAM blacklists. Marketer e360 Insight sued Spamhaus in an Illinois court to be removed from one of these lists, claiming that its legitimate mail was being blocked (in Illinois) due to Spamhaus’s actions. Spamhaus did not defend the suit, asserting that the U.S. courts lacked jurisdiction.

As often happens in such cases of default judgment, the court took at face value the arguments from the party who appeared and asked for a proposed order. The plaintiff then overreached (as is also common), and proposed [PDF] that ICANN be ordered to deactivate the Spamhaus.org domain name. The court has not yet acted on plaintiff’s proposed order.

Even if the court were to adopt this order, it would be open to challenge from many angles: ICANN is not a party to the lawsuit who can be bound by an injunction; ICANN has no contractual power to order a domain de-activated; Spamhaus challenges the court’s jurisdiction. In short, as some commentators have recognized, e360’s broad request is far from an enforceable order shuttering Spamhaus.org.

On the tech side, while loss of a domain name would be painful, as a domain may be the key point of contact for an Internet-based organization, it would not actually stop a newly-relocated spamhaus-is-now-here.info from putting e360 on the very same lists.

It’s clear we have a ways to go in reaching cross-cultural understanding. But I’m also thinking of how we can harness similar tech community outrage against other ICANN actions that have real impact, such as the sluggish process of approving new top-level domains and the shrinking of privacy options for domain name registrants.

By Wendy Seltzer, Law professor

Filed Under

Comments

John Berryhill  –  Oct 14, 2006 1:27 AM

Wendy,

Having gone through the filings on PACER, it seems that Spamhaus has chosen an odd way to challenge jurisdiction.

Howevever, I would reject the proposed order sua sponte for defective service.  The Certificate Of Service states that it was sent via email and via FedEx to a UK address.  While service via email has been carried out via email upon motion in various cases, simply saying that you sent it by email and FedEx is, IMHO, a fairly brain-damaged way to certify service upon a foreign defendant. 

Spamhaus is not actually challenging jurisdiction.  Their attorney, Evan Brown, filed an answer to the Complaint in July 2006, which expressly reserved the issue of jurisdiction, and then Mr. Brown withdrew in August 2006.  Since then, Spamhaus has not participated in the suit.

It would seem that Spamhaus is planning, if anything, a collateral challenge to enforcement of the monetary judgment in the UK, should the Plaintiff seek to enforce the judgment there.  As you know, that is a risky all-eggs-in-one-basket strategy.  However, it has always seemed somewhat bizarre that one can sue a foreign defendant almost anywhere in the United States based on the defendant’s contacts with the US as a whole, while in a situation such as Hearst v. Goldberger, jurisdiction in New York could not be enforced across the Hudson River to get at Ari Goldberger when Hearst challenged his New Jersey law practice’s use of the domain esqwire.com.  How it thus becomes easier to cross the Atlantic and arrive in the Northern District of Illinois seems… odd.

To the extent that the Plaintiff’s claims could be operating on the basis of an “effects test” of alleged harm, then Spamhaus’ publication of lists of IP address ranges as spam sources, combined with knowledge that those IP addresses geographically correspond to server locations in the United States, would suggest an uphill battle in an actual challenge to jurisdiction in this case.  Presumably, Spamhaus may believe it has a better chance in a collateral challenge in the UK, and that such chances must exceed their cost/benefit calculation of challenging the action on the merits in the Northern District of Illinois.

But, I agree the reporting on this case has been a monument to uninformed twaddle.

Kieren McCarthy  –  Oct 14, 2006 12:58 PM

I think I can offer some insight here into why the story has run so heavily in the media when normally you would expect it to barely register.

It has a number of sexy elements that act as flags to reporters looking for a story and which enable it to pass news editors.

First Spam - everyone hates spam. But then a large multi-million-dollar fine. Spamhaus refusing to answer the case - and so losing. A fight over the Atlantic. A judge getting angry and pulling in ICANN. ICANN rings vague bells - but it’s more the fact that it appears as though the company may lose its domain name.

This is just a good story. And *despite* a lack of knowledge of the issues by reporters and editors, it has enough elements to be worth following.

The problem is that the full story is very long and complex and neither reporters nor news editors have time to get into it in any depth. Plus, of course, if they did go into it in depth, the story would be too long and too boring for their readers.

And so matters are simplified and when you don’t have a depth of knowledge the simplification process serves to highlight the underlying assumptions - some of which turn out to be wrong.

The story was very complex and requires an understanding not only of the US legal system, but also how spam and spam filtering works, the different spam laws in the UK and US, the unusual legal situation that ICANN exists in, and an understanding of the case itself.

But the story still has to written and filed in three hours so you grab what you can - which is often other journalists’ stories because they are written to be easy and fast to understand. Then you try to find an expert to get a quote.

Above and beyond all of this, there is the overwhelming issue of the snowball effect. The more people that report on a story, the more legitimate the story becomes. As a news editor myself for Techworld.com, I was surprised when I saw the story was taking off - especially when it was only a proposed order for ICANN - but nonetheless I nearly approved a story on the issue anyway because it had become a hot news topic (I had run a story on the original judgement).

If a story has a buzz and people are discussing it, it is your job to give them the info, that’s just journalism.

These are the issues not covered though, as I see it:

* In the US, the emails sent by e360 Insight are not illegal because of the intrinsic free-market philosophy has led to relaxed spam laws. In the UK, they are illegal.
* Spamhaus sticks people like e360 Insight on its blacklist because under UK law they are spammers. It knows that under UK law it can’t be touched. But it also knows that under US law some of these spammers are not breaking the law. It has been sued several times in the US, and tends to ignore them because it has nothing to gain and everything to lose.
* Usually judges leave the situation alone. But for whatever reason the judge this time decided to buy e360 Insight’s line. From my experience, this was probably because the judge knew the attorney personally.
* People do not understand that proposed orders appear and disappear all the time in the US legal system. Nonetheless, it is still a proposed order. And it pulls in ICANN - and ICANN has been in the news recently.
* ICANN lives in a very complex and still unsettled legal situation that I’m not even sure John Jeffrey understands. It did well to recognise the risk that the story was creating a false impression of ICANN’s role and put out a statement explaining it couldn’t follow the order, even if it was granted.

At that point, to a news editor’s ears you have a judge creating trouble, a big Internet organisation refusing to comply with a court order, and at the middle a UK/US fight between a spammer and a company trying to stop spammers.

So that’s how the story gets written.

The reason why this won’t lead to more coverage of other, more pressing, real and important technical issues though is because it is a rare and aggressive interaction between big and powerful organisations.

That doesn’t tend to happen on other issues - or when it does, it doesn’t happen in public and people refuse to talk about it. In this case, because it was through the courts, all the info was out there.


Kieren

Suresh Ramasubramanian  –  Oct 14, 2006 8:33 PM

* Spamhaus sticks people like e360 Insight on its blacklist because under UK law they are spammers [..] US law some of these spammers are not breaking the law.

Spamhaus lists based on sending of unsolicited bulk email. Not based on can-spam compliance (which can be achieved even when sending UBE).  I would encourage you to read the spamhaus FAQ, such as the item at http://www.spamhaus.org/faq/answers.lasso?section=Legal Questions#107

There are a few other minor misunderstandings in what Kieran wrote but I’ll shut up about them for now.

Kieren McCarthy  –  Oct 14, 2006 8:47 PM

Hang on, I wasn’t saying that was the criteria that Spamhaus uses on deciding whether to stick someone on their blacklist.

I was pointing out why the court case exists in the first place, why Spamhaus didn’t contest it, and why Spamhaus is not some renegade organisation.


Kieren

Wendy Seltzer  –  Oct 14, 2006 9:03 PM

Thanks John and Kieren for the comments and clarification. 

Yes, it seems that Spamhaus started with some sloppy lawyering, filing for removal to federal court and then failing to pursue the case once it was moved there. Litigated properly, I’d think they’d have good jurisdictional defenses.  And even beyond those, we’re several steps away from an enforceable order.

Interesting the way blogs can keep a story alive for the non-blog media.  I’m glad we still have some journalists working to get more of the facts before filing the story, though.  (And I still wish it seemed more extensible to issues that don’t have the anti-spam buzz.)

—Wendy

The Famous Brett Watson  –  Oct 15, 2006 7:45 AM

Hang on, I wasn’t saying that was the criteria that Spamhaus uses on deciding whether to stick someone on their blacklist.
Kieren McCarthy

It looks like you are describing criteria when you say the following.

Spamhaus sticks people like e360 Insight on its blacklist because under UK law they are spammers.
Kieren McCarthy (emphasis added)

What I would like to point out, and what I think Suresh means to point out, is that Spamhaus isn’t using any particular jurisdiction’s legal definition of spamming as criteria for the SBL. Being listed on the SBL simply means you meet the SBL listing criteria. In many cases this does not imply that you are in breach of any law, UK, US, or otherwise. So far as I am aware, the Spamhaus criteria pre-date any legislative efforts, and were probably used as a starting point for many laws.

One of the unintended consequences of anti-spam legislation is what you might call a “false converse implication”. Having crafted a legal definition of what constitutes spam and outlawed it, pushy mailers who (claim to) work within the bounds of the law take the stance that it would be illegal to refuse delivery of something that is not spam. This is utterly bogus, in my inflexible opinion, but it’s the kind of situation we find the court supporting here.

A slight variation on this sophistry involves the stance that the local legal definition of “spam” overrules all others, so that a Spamhaus listing must necessarily be interpreted as an accusation of lawbreaking (precisely because “spam” now has a legal definition). This disregards the fact that Spamhaus has been operating in this manner since before a legal definition of spam existed anywhere (as far as I know).

There’s a great deal more that’s bogus about this case, but those are the things which spring to mind based on your statement that “Spamhaus sticks people ... on its blacklist because under UK law they are spammers.” Hopefully this clarifies why some consider it an important sticking point, and not a minor issue of semantics.

John Berryhill  –  Oct 16, 2006 6:47 AM

I was surprised when I saw the story was taking off - especially when it was only a proposed order for ICANN

But, Kieren, IT’S NOT EVEN THAT.

The proposed order is directed at Tucows.  ICANN is only mentioned in the document because Tucows is an ICANN accredited registrar.  Period.

It wasn’t a matter of simplifying the story. The “story” as circulating is wrong twice - first, in stating that a judge has issued an order at all; and second, in stating that the order has anything to do with ICANN.

It is along the lines of that North Korean missile that blew up San Francisco last week.

Kieren McCarthy  –  Oct 16, 2006 8:25 AM

Ah yes, but Tucows isn’t talking and hasn’t put out a press release. So its part in the saga is pushed to the sidelines.

I agree, the reporting has been inaccurate, but the reasons are complexity and the lack of immediate understanding. Plus, of course, it will most likely all come out in the wash (although sometimes, once the media has agreed a perspective on something, it is almost impossible to change it).

In all seriousness, though, John if this misreporting bothers you, there is a simple solution: hold yourself out as an expert.

This entails posting your thoughts - without direct criticism of the media - on a blog, then sending links to it to the reporters covering the story, complete with contact telephone numbers, and then answering their calls.

But it’s a double-edged sword and you would have to be willing to be quoted on a number of other Net issues because once you are acknowledged as a good person to call (and your name would be in lots of previous stories, so it would be a first port of call), because journalists would then use you as a good and fast source for clarifying the situation.

It can be very difficult to be accurate in a very short timeframe because there often isn’t the option of *not* writing the story. But an expert view can undo much of that. Which is why it’s a staple of journalism.


Kieren

John Berryhill  –  Oct 17, 2006 4:18 AM

hold yourself out as an expert.

This story didn’t require an “expert” to get it right.  Any US attorney with a pulse can log onto the ECF/CM system for that district court, spend three minutes looking at the docket, and see exactly what is going on here.

I mean, Kieren, you were in the same ROOM with me several months ago, and wondered in your report how many “hundreds of thousands of dollars [each speaker} had made that month”.  I could have told you how much billable time I lost by attending an ICANN meeting, but sometimes the facts are just too boring to report.

Kieren McCarthy  –  Oct 18, 2006 4:08 PM

I know it *shouldn’t* take an expert, but I was just trying to explain how and why, within the media processes, it does need one.

I can’t say I blame you for not wanting to take on a media expert role. It’s often like talking to a stroppy teenager. You have to be careful not to criticise while trying to explain that they may not be right. And then they go tell everyone a totally different version of what you said anyway. I’ve been on both sides of it many times.

As for American lawyers and making money, I’ve often tried to figure out how come I don’t get paid $200 an hour to supply solutions to people’s problems. My solutions *always* work out less stressful and less expensive ;-)

Kieren

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Related

Topics

Threat Intelligence

Sponsored byWhoisXML API

Cybersecurity

Sponsored byVerisign

Domain Names

Sponsored byVerisign

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global

New TLDs

Sponsored byRadix

DNS

Sponsored byDNIB.com