An Innocent Company Gets Snared in an Anti-Spam Sweep

By Paul Eng in New York
BusinessWeek, December 17, 1998

The World Wide Web has become such a routine part of consumer and business life that its original image as outlaw territory seems almost passé. Or so it appeared to Howie Swaim -- until the recent Thanksgiving weekend when he got a taste of "cyber-frontier justice" that paralyzed his two-week-old Web business.

Swaim appears to have been an innocent bystander in a passionate Web controversy -- what to do about obnoxious junk E-mail called spam. Anti-spam activists targeted the server hosting his brand-new site, Y2Kinformant.com, claiming it harbored spammers. In the process, the anti-spammers blocked crucial traffic for thousands of innocent online businesses that the server hosts, including Swaim's. His story is a cautionary tale of the vulnerability of companies that depend exclusively on the Web, which, for all its versatility, remains an environment where laws that protect businesses in the material world are hard to apply.

Swaim and his brother, Charles, started Lantus Systems, a Richmond (Va.) company, on Nov. 8, 1998. It offers paying subscribers information and advice on the worrisome Year 2000 bug.

Lantus, like many Web companies, does all its business via E-mail. But in late November, the usual E-mail flood slowed to a trickle, then stopped. At first, Swaim dismissed that as a holiday-weekend slowdown. When he returned to work that Monday, however, a private E-mail message finally reached him with the real reason -- Y2Kinformant.com had been branded a spammer, a distributor of those detested, anonymous messages that clog networks and electronic mailboxes. All incoming Y2Kinformant.com messages bounced back as undeliverable with a notice citing the Swaims' server as a source of spam. The Swaims were dumbfounded. Their newsletter and messages only go to paying customers and to others who seek contact with the business, they say.

Swaim was hardly alone, it turned out. As a two-person company, Lantus relied on Internet Communications Inc. in Los Angeles to host Y2Kinformant.com and provide E-mail services. With more than 15,000 clients, Internet Communications is one of the largest Web-hosting services in the L.A. area. According to Mark H. Kelly, its director of sales and quality assurance, Internet Communications has a strict "no-spamming" policy. But a few noncomplying clients caught the attention of a company of volunteers called Mail Abuse Prevention System, or MAPS LLC, which blacklisted the offending Internet Communications' server that generated the spam. The result: Nearly 7,000 Internet Communications clients were caught in the E-mail blockage for a week.

E-MAIL MESS. MAPS was founded by anti-spam activist Paul A. Vixie, a software developer, consultant, and longtime denizen of the Net. Vixie wouldn't comment on the Internet Communications incident. But he confirmed that MAPS's software was part of the problem: Messages returned as undeliverable identified MAPS as the reason. Vixie concedes that MAPS's tactics have "thrown out babies with the bathwater.... There have been times that I have blocked servers that have inconvenienced both spammers and nonspammers." But, he claims, "I have tried really hard to work with these providers to get them to host these spammers on other servers, so I can just block those."

MAPS, which is based in Redwood City, Calif., describes its modus operandi on its Web site: Volunteers peruse E-mailed spam and try to find the Internet servers that are generating offending messages by looking at the so-called IP addresses -- numbers that are unique to every server on the Net. MAPS also accepts E-mail from tech-savvy Web surfers who have documented evidence that a particular IP address generates lots of spam. The volunteers then try to contact server owners to persuade them to stop the spammers.

If MAPS gets no response, it places that IP address in its Realtime Blackhole List (RBL), which is sent to 2,000 Internet service providers (ISP) that subscribe to it. Their servers automatically reject all traffic from any IP address on the RBL. And that's where Swaim and his company ran into their E-mail nightmare.

Internet Communications' Kelly claims that the company does all it can to stop spamming. However, since the Web host gets more than 1,500 new clients each month, some spammers slip in. By Dec. 4, when Internet Communications persuaded MAPS to remove its name from the RBL, more than 1,000 of its customers were calling each day to complain of poor service, compared with an average of 400 normally. About a dozen customers left. "It was a definite impact on our business," Kelly says. The company initially considered filing a lawsuit, but it's taking a wait-and-see attitude now. "We understand [Vixie's] position," says Kelly. "Vixie does help and provide information to those ISPs that do need help" to stop spammers. Yet, he adds, "We do not agree with the heavy-handed approach he is taking. It's a nuclear approach to something that can be best done with a scalpel."

Lantus' Swaim, however, is talking to a lawyer about possible legal action against MAPS on the grounds that its blacklist inhibits free trade. Vixie says he's looking forward to a court challenge from someone to legitimize his efforts to block spam: "I hope I can get someone really well funded to sue me, so we can run around the courts and then it gets used as law." Tiny Lantus probably isn't that someone. Still, at the rate Vixie is going, he may soon get his wish.