Anti-Spam Zealots Cross the Line

Anti-spam vigilantes are combing the Internet for spammers and are enlisting ISPs to help thwart the culprits. It's a noble cause, but many say the cure is worse than the disease.

The MAPS RBL (Mail Abuse Protection System Realtime Blackhole List) is a list of e-mail servers with IP addresses known or reported to be harboring spammers. Individual ISPs or companies can subscribe to the MAPS RBL to block the delivery of e-mail from anyon e whose domain is on the list.

"My methods are heavy-handed," admits Paul Vixie, an Internet programmer and founder of the MAPS list. "But somebody has to do something."

Companies that have made it onto the blacklist include AT&T and Ziff-Dav is , who was reported because it had sent a mailing to journalists to announce an industry trade show. Virtually every ISP – including America Online , EarthLink, the Microsoft Network and Netcom – has either made an appearance on the MAPS RB L or has been threatened with inclusion on the list. Community site GeoCities has also been held accountable by MAPS for harboring spammers.

MAPS counts over 200 companies as subscribers, a third of those being ISPs. Even if your ISP doesn't subscrib e to the MAPS RBL, some popular e-mail programs, including Bright Light and Sendmail, offer the option to turn on a feature that will reject messages that come from a domain on the banned list.

And getting off the list is no trivial matter. In many c ases MAPS doesn't contact the administrator of an offending IP address until after adding it to the list. Then it waits for the ISP or company to change its business practices before taking it off the list. In the meantime, a company dependent on e-mail f or its livelihood will have lost business.

But Vixie figures that any company found to be harboring a spammer should upgrade its e-mail relay with software that prevents it from being used to send spam. "If you're sending spam, your network is hurtin g my network," says Vixie. "If you say 'it's too hard,' I'll ask, 'What's your schedule to fix your server?' If you don't answer, I assume there's no plan to remedy the situation, and you'll stay on the list."

Vixie's solution isn't pleasing everyon e. Howie Swaim, who operates a Web site called the Y2K Informant, found that e-mail sent from his domain was being bounced back to him. Swaim's IP address had been added to the MAPS list because someone – not an authorized subscriber, but a spammer w ho had gained access to the e-mail server – had sent spam from Swaim's ISP. The ISP was slow to contact Vixie about the problem, and it was weeks before the Y2K Informant had normal e-mail capabilities.

"They're doing this with absolutely no jus t cause or legal jurisdiction," complains Swaim. "The ramifications of this are tremendous as it means that ISPs are claiming jurisdiction over our very basic First Amendment rights." Swaim has taken legal counsel and is looking to sue MAPS.

Mark Bou lding, Swaim's attorney with Washington-based firm Long, Aldridge, and Norman, believes Vixie has broken state computer-trespass laws prohibiting unauthorized interference. He thinks no one has yet sued Vixie to date because it might be difficult to colle ct damages and because no one wants to be perceived as pro-spam. "We're all anti-spam, and no one wants to attack the leading anti-spam crusader," says Boulding. "But Vixie refuses to consider the innocent bystander. He holds people like Howie hostage to put pressure on an ISP."

But Vixie is unruffled by the prospect of a lawsuit. He sees his mission as almost messianic, and compares himself to a civil rights worker. "Imagine yourself in the place of a civil rights advocate before abortion was legal ," he says. "My inbox is my property." In fact, Vixie says he would welcome legal action. "We need something that can be used as case law to defend our rights," he says.

Among antispam Usenet groups, Vixie is revered as a hero. A recent target of the discussion groups is Alan Bechtold, president and founder of Web hosting business BBS Press Services. Bechtold, who was on the MAPS list, had sent a series of angry voice and e-mail messages to Vixie demanding to be removed from the list.

"I wouldn 't take his calls because he was too angry, and we couldn't e-mail because he was on the list," says Vixie. Instead, the battleground moved to the Usenet arena, where Bechtold found himself embroiled in a nasty feud with Vixie's supporters.

"I admit I was belligerent and pissed off," says Bechtold. "But [people] forget that someone may be pissed because they are innocent."

In the end, Bechtold was justified in his outrage. "It turned out that he had already found the guy on his service who was sending spam and kicked him out for it. So he was one of the good guys," says Vixie.

Some anti-spammers think Vixie's methods aren't aggressive enough. In the next couple of weeks an organization called the Internet Mail Relay Services Survey , which inherited a database of spammers from a group called ORBS, will begin publishing its own blacklist.

ORBS published a list of some 50,000 servers known to be used by spammers. The IMRSS expects to find many times that number. Unlike MAPS, the IMRSS will not notify ISPs of inclusion on the list before they are put on.

"Innocent bystanders will get hurt, but what alternative is there?" asks Ron Guilmette, project coordinator for the IMRSS. "Spam is a damn difficult problem, and sometimes you will throw the baby out with the bathwater."