released 02 apr 05 / last mod 01 jun 07 / greg goebel / public domain
* Brian McWilliams' book THE SPAM KINGS is a narrative of the activities of a number of spam artists and those who oppose them over the last few years.
The central figure in the book is Davis Wolfgang Hawke, a chess enthusiast who made his first mark on the world by running his own hobby neo-Nazi party over the Internet out of his dorm room at a liberal New England college in the late 1990s. This exercise came to a fizzle when local reporters found out that he was born Andrew Britt Greenbaum, an unlikely name for a Nazi. In reality, his fraction of Jewish blood was low enough so that Adolf Hitler himself wouldn't have stressed about it -- much -- but the damage had been done.
Hawke tried to carry on, but his Aryan dreams finally collapsed in August 1999, when he tried to conduct a Nazi march in Washington DC. Nobody came except a large number of anti-Nazi protesters, who chanted: "Ho ho ho, the Nazis didn't show." He ended up dropping out of school, his parents all but disowning him. Oddly, he stayed on good terms with his grandfather, an official at the Massachusetts Institute of Technology, who seemed beyond the age of worrying about such things and was amused by his grandson's theatrics.
There was a silver lining in all this for Hawke. He got out of the Nazi business and sold off his Nazi knives and medals over EBay. He was astounded at how people would bid up items to twice the price they were worth. The lesson was simple: there was money to be made on the internet from stupid people.
* In the meantime, a middle-aged California woman named Susan Gunn had become annoyed to find unsolicited ads flowing into her America Online (AOL) account. Like almost everyone who hadn't seen "spam" before, she was naive, thinking AOL was behind it, and also sending back an "unsubscribe" reply to get off the list. Actually, this just validated that her address was live so spammers could hand off her address to other spammers. She ended up getting more spam.
Most folks in her situation would have quickly grown tired of trying to come to grips with something so evasive, but Sue Gunn was, to put it bluntly, pigheaded; she was the kind of person who would get into quarrels on internet forums and carry them on indefinitely when everyone else was begging her to shut up. In early 1999, when her AOL mailbox finally became useless due to the torrent of spam, she got into the "news admin net-abuse email (NANAE)" newsgroup on USENET to learn more. She might have been pigheaded, but she was also very smart and proved a quick study, learning the ropes even though she had little formal technical background. She became the "goddess of NANAE", tireless and eager to take on spammers.
NANAE was riding high at the time, having forced a big-time spammer named Sanford Wallace out of the business the year before. "Spamford" Wallace was not secretive about his activities, getting onto NANAE to defend his "First Amendment right" to be a spammer, or as he preferred to describe himself, a "bulk email marketer". By late 1996, outfits like AOL were trying to sue him, though they were testing the waters, nobody being too sure at the time if there was actually a legal basis for such lawsuits. Wallace was fighting back with lawsuits of his own.
In 1997, some unknown NANAE contributor who called himself "Hacker-X" decided to take matters into his own hands and cracked the computers of Wallace's Cyber Promotions company. He released information that allowed others to repeatedly hijack the Cyber Promotions site, with one inserting a picture of a can of SPAM with the caption: "CYBERPROMO -- NOT JUST BULK EMAIL -- IT'S SPAM!" Wallace's website was then hit with repeated denial-of-service (DOS) attacks, flooded with so many requests that nobody could get in. Wallace tried to fight back with a certain inspiring stubbornness, posting a $15,000 USD reward for information leading to the arrest of Hacker-X.
However, the attacks were merciless, so much so that some NANAE contributors felt the antispammers were putting themselves on the wrong side of the moral issue. In the spring of 1998, after putting up a long loud fight, Wallace threw in the towel, graciously conceding on NANAE and saying the "antis" were "WINNING the war against spam!" That would prove to be overstating it. Wallace was a person with some scruples, willing to be upfront about what he was doing and publicly fight for his right to do it, but not all spammers had that level of integrity.
* The case in point was Davis Hawke. By the fall of 1999, he was living in a trailer in the woodsy regions of South Carolina with an girlfriend ten years his senior. He was searching around for some way to make easy money and stumbled on spamming. His first attempts were pathetic, with his accounts quickly shut down by his internet service providers (ISPs) and no money to show for the effort. However, he was a quick study himself, figuring out that the best time to blast off spam was on Friday evening, meaning he wouldn't get shut down until Monday morning at earliest. The websites he used to pick up orders for the stuff he was spamming were prone to getting cut off too, but he would always keep a backup website on hand. When one was shut down, he'd just shift the domain name to the backup, and then create another backup for the new site.
He started out selling manuals and CD-ROMs on how to spam, and they actually had plenty of good information on the subject since Hawke seemed to be a "natural" at spamming. For example, he described the relatively naive AOL user as a prime target for spamming, like hunting a "12-point buck with a ribbon on his head." He then enhanced the CD to include all sorts of other information downloaded from the internet useful to those inclined, as he was, to screw with the system and the rules. He finally was bringing in enough money to pay the bills -- when he bothered to. Davis Hawke was the sort of guy who avoided paying bills whenever he could, even when he had the money, out of a near-religious conviction in screwing over everybody on the principle of the thing.
* In the meantime, Sue Gunn was finding her own fulfillment in taking on spammers from her roost in NANAE, contacting ISPs to get them shut down and also trying to confront the spammers. She thought she could reason with them, or at least argue with them, though some other NANAE contributors told her she was naive.
A lot of the spammers were easy to shut down, laughable amateurs who tried to spam out of an AOL account. NANAE folk called these novices "chickenboners", envisioning them as living in a trailer with a PC on a table littered with empty beer cans and cardboard Kentucky Fried Chicken buckets filled with week-old chicken bones. The chickenboners were small fry, but the philosophy was that it was better to contact the ISP right away and nail them -- NANAE referred to the contact message as a "Loser Attitude Readjustment Tool (LART)" or "mallet" -- before they became big-time spammers.
Oddly, the antis and spammers sometimes cooperated, sort of as in a devious "spy game" where two opposing sides might work together for a common purpose, with the obvious danger of betrayal. One spammer actually photocopied Gunn a copy of a "pink contract" with a major ISP who he felt had screwed him over, the "pink" referring to spam. Some ISPs tended to have cozy relationships with spammers, since the high-bandwidth services obtained from the ISPs by the spammers were very profitable for both parties. There were generally rules in such companies against providing services for spam broadcasts, but it was convenient to look the other way at times, and so some ISPs chose to ignore the tens of millions of emails being blasted out over their connections even though it was obvious what was going on.
It probably wasn't usually a case of any deliberate policy of signing up spammers, but anyone who's ever worked for big business organizations knows about their tendency to focus on the bottom line and brush off other issues, and also knows that some sales reps will all but sell their souls to make a deal. Whatever the motives, some ISPs were way too friendly to spammers. Anti-spammers did their best to hassle ISPs seen as soft on spam, and Gunn's pink contract was a big-time smoking gun.
She was so sharp and energetic that by the fall of 2000 she had been recruited by a Briton named Steve Linford to help construct a "Register Of Known Spamming Operations (ROKSO)". Linford was of entirely different cut from the more or less technogeek NANAE crowd, being an urbane, articulate Englishman with feet in both the rock music and software businesses. He had established a British antispam site, "Spamhaus.org", and was looking at ROKSO as a bigger mallet for hitting spammers over the head. ROKSO would in fact become a major nuisance to spammers, since operations like AOL and Microsoft would use it to drive their spam filters.
The NANAE crowd continued their usual attacks on spammers in the meantime. One of their big targets was George Alan Moore, a spammer of herbal diet pills known as "Dr. Fatburn". He was a little along the lines of Sanford Wallace, willing be upfront about what he was doing and having some scruples about it, at least at first, and also engaged the antis in the NANAE newsgroup.
Dr. Fatburn would come into contact with Davis Hawke, who was diversifying his spamming efforts into vials of pheromones that would supposedly make a guy a "babe magnet", and more importantly from Dr. Fatburn's point of view, herbal fat pills. Hawke simply lifted Dr. Fatburn's web pages and tweaked them a bit for his sales effort. It was lucrative: Hawke bought his bottles of fat pills for $5 USD, sold them for $50 USD, and the orders were rolling in.
Only very small percentage of people would bite, but with millions of emails in each spamming session that meant Hawke was starting to make some comfortable money. He had been moving around with his girlfriend in the backwoods of South Carolina, North Carolina, and Tennessee, leaving stashes of greenbacks buried in the forests. Hawke did not believe in banks: people who were after him would be able to get their hands on his money if he left it in a bank, and it was obvious to Hawke there were going to be a lot of people after him sooner or later.
Hawke and Dr. Fatburn would come to an understanding, but with spammers there were no permanent understandings, and they would fall out again. Dr. Fatburn would get out of the spam business in 2003 after getting nailed in court for selling off pirated copies of Symantec anti-virus software.
That was later. In the summer of 2001, Hawke went back to New England. He was back attending chess matches, under the alias of "Walter Smith" -- Hawke had a list of AKAs as long as his arm -- and ran into some old acquaintances. He also made some new ones, most significantly Brad Bournival, a younger chess player, ranked higher than Hawke. Hawke decided to bring Bournival into the spam business as a partner.
Bournival was so naive that he hadn't even heard the word "spam" before, but he was another quick study. They would get into selling organ-enlargement pills and would rake in the money at an astounding rate. Hawke also considered going into the online porn business, but it turned out to be too much like work, and he wasn't really that enthusiastic about it anyway. One of the reasons was that the Mob was said to be heavily involved in online porn, and they were the kind of people that even Hawke thought twice about screwing over.
* The war between the antis and the spammers would sometimes get really nasty, with antis figuring out the home addresses and phone numbers of spammers and putting them up on the Web. A torrent of harassment would fall on the spammers. Of course they retaliated in kind. One even told Sue Gunn where she lived and what her phone number was, and showed her pictures taken through the windows of her house. This was a thinly-veiled threat: a few spammers were making violent noises about what they wanted to do to the antis.
The spammers also had their own particular weapon to use against the antispammers: spam. They would release floods of spams with outrageous statements and links or phone numbers of antis. These exercises were called "Joe-jobs", in reference to a fellow named Joe Doll, who had been one of the first victims of them a few years earlier. In the aftermath of the 11 September 2001 terrorist attacks on the US, some of the spammers went completely off the deep end in their Joe-jobs, trying to link the antis with Osama bin Laden and al-Qaeda. Others cashed in to the calamity: Scott Richter, a well-known Denver-based spammer, patriotically sold American flags, claiming he gave the profits to charity.
Spammers also tried to press lawsuits on the antis over various pretexts. Sometimes this tactic worked; there were other antispam lists besides ROKSO, and spammers had in some cases legally bludgeoned them into ineffectiveness. However, this tactic could backfire. To press a case in court, a spammer organization basically had to reveal itself and identify the people running it, which left them open to counterattack. An Atlanta attorney named Pete Wellborn earned a reputation for providing energetic and effective legal defense for spamfighters, and also taking the legal offensive against spammers. A picture of Wellborn showed him to be a hefty guy, built like a football linebacker, eyeing the camera with a mock-grim scowl on his face and a sledge hammer in his hands, in reflection of his nickname, the "Spammer Hammer".
Some antis tired of the game and dropped out. Some even joined bulk-email firms, much to the consternation of NANAE contributors. The dropouts defended their actions, claiming they intended to provide some oversight that these firms wouldn't otherwise have, and there was a faction in NANAE that supported their decision. Still, it was a discouraging development. There would be more of the same.
By this time, Davis Hawke was definitely on the radarscope of the NANAE crowd. He did his best to dodge the ROKSO list, and one of the ever-shifting names of his and Bournival's company, "Quicksilver", was only too appropriate. When Sue Gunn ran across Bournival's name, she told NANAE that it was probably just another one of Hawke's many AKAs. It came as a surprise that Hawke was building up a network of contacts.
In fact, he had assembled a large social circle after returning to New England, with the circle ironically including many non-Anglos. Although Hawke had basically given up his Nazi ways in favor of making money, he remained a white supremacist at heart. Despite that, in practice he didn't seem to have any problem associating with non-whites, possibly because he didn't have much respect for anyone, white or non-white. Bournival noted irritably that Hawke liked to call all the shots with his crowd, and with all the money Hawke was throwing around he could get away with it.
* The race between spammers and antis was beginning to become more focused on the technological edge. By early 2003, AOL and other big providers had spam filters that really worked, and spammers like Hawke and Bournival were starting to feel the pain. The spammers had the tools to fight back, however, figuring out ways to evade the filters, which escalated the race to build better filters, a task the big service providers found expensive and frustrating.
Worse, hackers had traditionally hated spammers, but now there were hackers, most significantly virus-writers and the like, who had taken up spamming themselves or were working for spammers. By the beginning of the summer of 2003, Steve Linford was finding that spam was increasingly coming from "zombie" PCs that had, unknowing to their naive owners, been hacked, taken over, and turned into spam servers. Worse, viruses were propagating that took over legions of PCs and then conducted synchronized DOS attacks on Spamhaus.org and other antispam websites.
In principle, the spammers took a major legal blow when the US Federal government passed a comprehensive law, the "Controlling the Assault of Non-Solicited Pornography And Marketing (CAN-SPAM)" act, on 22 November 2003. In practice, many of the antispammers wailed.
CAN-SPAM had a major weakness: a spammer was free to send email until a recipient asked to "opt-out", and an "opt-out" had to be given separately to each bulk emailer. A provision was made for the US Federal Trade Commission (FTC) to set up a "Do Not Spam" list, but no funding was provided. After being badgered about the list for some months, the FTC came out and flatly refused to do it, claiming in absolute truth as long as spammers were able to conceal their identities, such a list would simply provide them with more addresses.
There was really little said about providing enforcement in CAN-SPAM, and the law enforcement agencies affected admitted that computer crime was a low priority. Considering the other issues on their plates, nobody could really blame them. People could claim damages against spammers under the law, but collecting the money required going through a legal system that wasn't set up to do it.
No wonder the antispammers howled. The CAN-SPAM act had replaced a number of very tough US state laws with a new law that lacked teeth. The notion that users could "opt out" under such circumstances simply made it easier for spammers who didn't try to follow the law, which would turn out to be most of them, to harvest validated email addresses.
CAN-SPAM didn't come close to the tough antispam law passed in Australia, regarded as a model by the antis, though Steve Linford, always cool and articulate, said CAN-SPAM had its positive aspects. The law made forging email headers on a bulk emailing a crime: that meant that spammers could no longer legally try to conceal their identity. If they adhered to the law, they could be dealt with using spam filters. If they didn't, then if somebody caught them and took them to court, they wouldn't be able to dodge the bullet, and such spammers wouldn't dare take an anti to court in retaliation. Even given weak law enforcement, organizations like AOL and Microsoft were spending hundreds of millions, even billions, fighting the spammers, and could afford to hunt the worst of them down.
* By the end of 2003, Hawke and Bournival had, surprisingly amicably, parted company. Hawke had come up with a scheme for spamming cellphones, a trick that was already common in Europe but was new to the US, which lagged about half a generation behind in cellphone technology. Bournival thought it wasn't a good idea. An email could give a hyperlink back to a website for an order, but all that could be done with a cellphone at the time was leave a 160-letter message with a toll-free number. Spamming always meant complaints, but Bournival thought spamming cellphones would not yield enough money to make it worth the bother, and decided to go his own way.
Hawke went ahead. It was too easy: he just cycled through an email list of addresses of the form "<phone_number>@Sprint.com" or whatever, trying every possible phone number. The addresses didn't even have to be harvested, and there were no spam filters on cellphones at the time. Early in 2004 he launched his cellphone spam offensive, but it turned out just as Bournival had expected: a tsunami of enraged complaints and very few sales. Hawke, never easily discouraged, did keep working at it, and started to bring in a little money.
In the meantime, the big guys like AOL and Microsoft were using CAN-SPAM as a big mallet to hit high-profile spammers over the head. Scott Richter had made a bundle after the US invasion of Iraq by selling a deck of cards with mug shots of Saddam Hussein's regime on them, but now he was up to his neck in litigation. He was so brazen as to try to sell T-shirts that advertised him as the "Spam King", but the Hormel meat packing company told him he was in violation of their trademark and that he should cease and desist immediately.
Then, on 10 March, Bournival was reading Yahoo! News and found out that he and Hawke had been hit by a $10 million USD lawsuit from AOL. He got in touch with Hawke, who laughed it off, asking how AOL would get the money out of him; the only way to find it would be to dig up his money caches in five different US states. He was also very hard to track down, having a tendency to move around a lot, pay for everything in cash, and cover his tracks with AKAs.
Bournival had been less paranoid and had been keeping his money in banks and the like, making him much more vulnerable. It appears that Bournival was basically a decent kid who'd never had much money and was just dragged into spamming by the lure of fast cash, and wasn't of the same cut of the incurable ripoff Hawke. Bournival took a very cooperative line with AOL, singing like a canary, even fingering two AOL employees who sold off AOL customer address lists to spammers. The employees ended up staring down the muzzle of serious jail time.
Hawke, at last notice, was continuing to spam away merrily. Although AOL hired private investigators to track him down and won their judgement against him, collecting was another matter. He may prove right yet in thinking the lawsuit against him was an empty threat. Under pressure, he could declare bankruptcy, and nobody could touch any of his money caches since he's the only one who knows where they are or, legally speaking, that they even exist. In the meantime, he continues to build up padding.
This discouraging lesson was not lost on some antis. Sue Gunn basically became a lurker on NANAE, rarely posting and showing little of the enthusiasm she had once had for fighting spammers. For all her efforts, spam had continued to increase, until it was literally threatening to drown out legitimate email on the Internet. She had started out thinking that spammers could be convinced of the errors of their ways, to realize that Hawke and his kind had an "attitude": Screw you. Screw everyone.
Worst of all, at the bottom of the problem was the small fraction of suckers who bought from the spammers and kept the whole thing alive. AOL and others attempted to conduct an educational campaign to get their users to "say no to spam", but anybody so clueless as to buy useless, even ridiculous, products at gross markups, giving their credit card numbers to blatant crooks, was beyond all help. The campaign was given up after a year.
Spam was here, and it didn't seem inclined to go away any time soon. The spammers were roaring in big trucks down the information superhighway, hidden in the dark of night, dispensing clouds of advertising fliers behind them until the road was carpeted by them, and nobody could say when things would change for the better.
* THE SPAM KINGS tells an interesting story, but the way it is told leaves a bit to be desired. The author is clearly experienced at writing articles, but he has yet to be learn how to write a full-fledged book: this item seems mostly like articles that have been chopped up and glued together, instead of a structured narrative. That being said, the topic matter is interesting enough to carry the story, and it's still a fun read. However, I would suggest that readers not to expect something that's going to win the Pulitzer prize.
