Spam Shuts Down Legitimate Websites

Legislative "solutions" to spam, proactive blacklists, and reactionary backbone providers only harm legitimate ISPs and their customers as the problem continues to grow.

by Alex Goldman ISP-Planet Associate Editor [July 14, 2003]

Albuquerque, N.M.-based FatCow is a webhost that has solved the branding problem and is now well known. The company claims customers in 87 countries, and also claims to be the largest Internet business in New Mexico.

But for Larry Donahue, COO and in-house legal expert, the cow is fine but the spam is a problem. "I see our spam problem in two ways," he says. "One problem is incoming. We think we have 1 TB of e-mail each week, of which about 60 percent is spam. The other problem is that on any day, we'll receive 50 spam complaints from the outside. 90 percent of spam complaints we receive are false positives."

Donahue says that website owners are guilty until proven innocent, in current practice. "There's no due process. We give them one warning and if they do it again we kick them off. If it's fraud (gambling, drugs, sexually explicit materials, or Ponzi schemes) then the decision to boot them is easy. But in other cases, it's someone sending a newsletter to their customers, and one, or two, or five go to a shared mailbox where a spouse doesn't know someone's signed up for it and they fire off a spam complaint."

He says webhosting customers can produce lists showing who's opted in to their service, but that nothing the customer can do will prove them innocent. "The blacklists don't care, and backbones cannot process opt in lists. For example, one backbone called us and gave us a 5 hour disconnect notice, accusing us of being a spammer. They would have shut us down. They had 20 false positives and 3 legitimate complaints. Of three legitimate complaints, 2 were fraud websites that we shut down. The third was a site selling religious symbols and beads, and sending out newsletters. That was a customer we wanted to keep but the backbone provider made us ditch them. Companies like us are under constant pressure to not apply due process."

Some legitimate websites, those that aren't breaking any laws but cannot afford to hire lawyers and defend themselves, are becoming nomads, going from ISP to ISP over the course of a year, forced to move because of illegitimate spam complaints.

Too many chefs make a bad spam omlette
Congress is ready to act, but it is listening to the concerns of end users and does not understand even the most basic aspects of the problem, such as spoofing. There are nine laws currently proposed (to view them, visit the Congress website and type "spam" into the "Word/Phrase" search engine).

Lawmakers need to define clear arbitration procedures. "Many proposed bills have a safe harbor clause for ISPs," says Donahue, "but they also force ISPs to act. So what happens if someone falsely identifies my organization as spamming?"

There are other subtle situations that may be even more complex. "What if my customer installs a CGI script with a security flaw? A spammer could route spam through a customer's account."

If the law is not clear on any point, it will go to courts, where the law will be clarified, but that clarification process will be expensive for ISPs.

Spam identification programs are starting to use reverse DNS lookup. But anyone employing reverse DNS lookup on a FatCow customer will get a FatCow IP address. "If we change the DNS, then our competitors will poach our customers," says Donahue. "That's why it's an industry practice to not put the real address of customers in DNS tables."

ISPs will have to get involved in the process. "We're talking to our local Representative, Heather Wilson, who has sponsored the anti-spam bill H.R. 2515," says Donahue.

Until these legal questions are resolved at the Federal level, Donahue worries that the laws will vary state-by-state, and with customers across the nation and around the world, that could be a big headache for Internet companies like FatCow.

Meanwhile, the company is also looking at anti-spam products, but none are perfect. Instead, the problems are likely to continue, and, as spam is profitable (at least in the short run, before the lawsuits catch up with the spammers), the problems will probably get worse.

— End