ICANN Grants Temporary Reprieve to Spamhaus

daringone writes "ICANN released a statement that says they "...cannot comply with any order requiring it to suspend or place a client hold on Spamhaus.org or any specific domain name" They do, however leave the door open for the registrar that registered the domain name to then be forced to turn the lights off for Spamhaus."

Huh?

Can somebody explain that in English please?

Re:Huh?

Basically, ICANN is saying, "It's not our job to suspend domain registrations; it's the registrar's job. We just coordinate registrars."

Re:Huh?

So in layman's english ICAAN is simply saying ICAAN'T.

PIR are the ones who could do it.

I think the likely choices are either Tucows (as the registrar) or the Public Interest Registry [pir.org], who is the actual maintainance organization for the .org TLD.

I'm not sure how PIR is structured and how responsive they would be to a U.S. court order -- a lot of their board of directors seem to be European, although their mailing address is in Reston, VA, and I'm not sure where they're officially incorporated -- but Tucows is probably in a position where they have a lot to lose if they ignored it.

Still, can a registrar really "pull" a domain? It's the PIR that maintains the root DNS servers for the TLD, so if they decide to just not delete spamhaus's DNS entry, then the domain stays active. Tucows basically sends requests to the PIR to add new DNS records when someone registers a new domain, but they don't (at least, I don't think they do) actually operate the servers themselves. What is Tucows supposed to actually do?

It would be interesting if PIR just said "no" to the order, once it goes to them from Tucows, and refused to do it. There could be some very interesting precedent as a result of this: should a U.S. court have the authority to pull a domain belonging to a non-U.S. corporation or citizen? Should a German court be able to order a domain for a U.S. corporation or citizen pulled? How about a Saudi Arabian court?

Re:Huh?

Basically, ICANN says that they've not been ordered to act and suspend the spamhaus.org [spamhaus.org] domain, and even if they had they couldn't do it "because ICANN does not have either the ability or the authority to do so".

They also state that ICANN is not party in the lawsuit and is not involved in it.

They end their posting by stating that only spamhaus.org's registrar or the Internet Registry have the ability and authority to suspend an individual domain name.

They close their posting by stating that this comment was made in response of the community's interest (in the ICANN's position on the matter).

Re:Huh?

Spamhaus has already said that they do not want to go this route [spamhaus.org]. Their reason:

The reality is that if Spamhaus gets around the court order by switching domain to maintain the blocking, the judge would very likely then rule us in criminal contempt. We don't want a criminal record for the sake of fighting spam. We normally help fit the spammers with criminal records, not the other way round.

While it's technically true that they could get around it, legally, it's not a great idea.

Re:Huh?

ICANN is the organization responsible for all domain registration. They were ordered to remove spamhous.org 's registration, and as the article says, have refused. The registrar that sponsors their domain, Tucows Inc., could still be ordered to cut their registration -- if that happens, watch your inbox for deluges of spam. If the registrar was GoDaddy or someone high profile like that, we'd probably be alright .... Tucows ... we're screwed.

Which while annoying briefly, might be a Good Thing(tm). Face it, those who use services like Spamhaus probably don't realize *how much* spam there is. If your government official gets 1 spam in 20, well, they thing "just hit delete" works fine if their total spam load is 1,000 emails a day (50 spams get through). If, on the other hand, they suddenly are hit with the full brunt of it, there may be changes. Imagine Grandma who gets 5 or 6 spams a week after her ISP's filters (which probably are quite effective). And then suddenly getting 600 a day. It may open up the eyes of those who don't believe it to be a problem because they're sitting behind a wall protecting them. It's just we've all been sitting "behind the wall" to see true increases. When the amount of mail that makes it past the filters doubles, total traffic may have increased 10 times or more.

This might encourage development of a new email infrastructure that gets rapidly adopted by the Internet, suddenly faced with the realities of how much spam there really is in the world.

I for one, would love to see the end of poorly-configured MTAs who send me bounce emails that are improperly formatted. Of all things an MTA should do, is to generate proper emails! Otherwise they're contributing to the spam problem (I've got hundreds all addressed as "Mailer Daemon " and even more from antivirus/antispam systems, and nevermind whitelist systems. They all seem to contribute to the spam problem by generating even more email in response to email.)

Re:New e-mail infrastructure?

One of the beautiful things about the Internet is that anyone can setup the services they want. Some are abusive, most are not. Your proposal says that individuals have no reason to do what they want to do. The only way to go is to trust corporate-supplied services. That is not the Internet I signed up to.

Re:Huh?

It's a bit different than that.

Spamhaus is not based in the USA, and has no offices in the USA, so therefore the court has no jurisdiction to sieze anything from them. It's even dubious that the judge has the right to sieze the domain name, as it's registered with another non-US company. ICANN is just saying "Don't bother slapping us with a subpoena because we can't do it anyway."

This has much further reaching implications than it may seem at first. First Spamhaus, then online gambling sites that are perfectly legal in other countries. After that will come torrent sites, crack sites or anyone who does anything that might be illegal in the USA but legal elsewhere.

It's a slippery slope.

Re:Huh?

According to a very interesting analysis of the case [securiteam.com] which was originally linked from another /. story on this case a couple of days ago, Spamhaus's problem is that they tacitly accepted the court's jurisdiction at the start, which makes it very difficult to claim otherwise now:

"Spamhaus may have waived personal jurisdiction as a defense early on in the case when they not only appeared, but then asked for the case to be removed from state court (where it was originally filed) and moved to federal district court (where it is today). Arguably, and this makes sense intuitively even if you don't understand the finer points of U.S. civil procedure, doing so inherently acknowledged the jurisdiction of the federal court."

You missed a step...

12 Second History
Spamhaus listed E360 as spammers
E360 sued Spamhaus in an Illinois court, saying that they weren't spammers.
Spamhaus said Illinois court has no jurisdiction, take it to Federal courts.
E360 sued Spamhaus in a Federal court, saying that they weren't spammers.
Spamhaus doesn't show up to Federal court, despite having accepted their jurisdiction.
E360 won a default judgement because Spamhaus didn't show up.
Spamhaus still said the court had no authority and ignored the judgement.
E360 filed for an injunction, asking the court to order either ICANN or the domain registrar to block the Spamhaus domain because Spamhaus ignored the judgement.

Check out this Illinois lawyer's take on the matter for the full(er) explanation:
http://blogs.securiteam.com/index.php/archives/664 [securiteam.com]

Re:Huh?

OK, in "modern english" from my amateur interpretation of the article (feel free to correct me)

e360 has joined the chat
spamhaus has joined the chat
e360: omg we aren't spammers so we sue u becos u think we are!
spamhaus: ...
court has joined the chat
court: spamhaus won't reply, so default judgement of $12 million in litigation costs for them
court: oh, and u must remove e360 from ur spammer list now!!
court: and btw, tell u did wrong on ur website...
icann has joined the chat
icann: wtf! whats e360 claims based on anyway??
e360: omg take down every spamhaus domain until they comply with court's order! FFS
tucows has joined the chat (= Spamhaus.org domain registrar)
tucows: ??? wtf is all the ruckus about!
e360: just sign the papers to bring down the assholes u idiot
** start of these news **
icann: i dunno... but WE cant do shit.. we lack teh authority..
icann: spamhaus never wrote a contarct with us... its up to tucows i guess
icann: hell we werent even brought to court properly by 360

Will be interesting to see how it unfolds... If I understand things right, TUCOWS has not responded.

Just remember...

Judges aren't required to know how technology works, they just make rulings that affect it.

A Little Background

From Wikipedia [wikipedia.org]

The Spamhaus Project is a largely volunteer effort founded by Steve Linford in 1998 that aims to track e-mail spammers and spam-related activity. It is named for the anti-spam jargon term coined by Linford, spamhaus, a pseudo-German expression for an ISP or other firm which spams or willingly provides service to spammers.

Spamhaus is responsible for the two most widely-used DNS-based Blackhole List (DNSBLs, also known as Real-time Blackhole List or RBL) in the anti-spam arena -- the Spamhaus Block List (SBL) and the Exploits Block List (XBL). Many internet service providers and other Internet sites use these free services to reduce the amount of spam they take on. The SBL and XBL collectively protect almost 500 million e-mail users, according to Spamhaus' web page (April 2006).

TUCOWS

spamhaus.org is registered by TUCOWS who are a Canadian company and thus not subject to Illinois law.

(If you haven't been following the 360 Insight vs Spamhaus [vnunet.com] thing then you'll have no idea what's going on here!)

Re:TUCOWS

Being incorporated in Canada does not exempt them from Illinois law. That's like saying a Canadian citizen can't be prosecuted for crimes committed in Illinois.

You're oversimplifying. First, this is civil law, not criminal. Second, no crime was committed. Third, This is an Illinois court ordering a canadian company to suspend a service they contract to a UK organization. If the service is provided in the US, then the court might have the authority, but if the service is not, there is some serious question of jurisdiction here. You can't go ordering companies that do business both within and outside the US to take arbitrary actions outside the US in response to civil suits within the US.

Might I suggest?

We should add a few letters to ICANN's name, therefore making it "ICANNOT." They literally supervise domain names and the IP space, however that's about it.

Now if Spamhaus registered the domain with GoDaddy, all 'e360' needs to do is say the site contains some severely questionable content and down the domain will go. GoDaddy has a good history with that...

Good for ICANN

ICANN demonstrated intelligence and restraint here. They could have attempted to 'grab' power, using the court order as an excuse.

Instead they demonstrated an admirable restraint and intelligence, in a situation where both the Judge and Spamhaus have failed to do the same.

Good Idea

Main idea IMHO is that in this way ICANN can say, nicely, NO to US court ruling. If they agreed they would actually gave up their independence and would become easy target for more attacks from US jurisdical system.

In this way they effectively explained themselves from executing court orders.

Good job for freedom of speech ICANN!

Big hoopla for nothing

This is just a big hoopla for nothing. Basically, what happens is a spammer is just taking his wet-dreams for reality, nothing else, and he's been able to do so by misrepresenting facts to a judge that can only act on the facts. You know the old adage: "garbage in, garbage out".

The pity here is the media circus surrounding it which has made this the big mountain it isn't.

I want an injunction

against people who throw away their junk mail without reading them. This adversely impacts the freedom of expression of the local pizzaria, the local grocery store, those carpet cleaning guys, the 12.99 oil change people, and the used car salesmen.

Also I want that judge to decalre the "do not call" list created by the US Govt illegal. If someone talks to you, you have to drop everything and listen. If someone sends you a piece of junk mail, you must read it.

How asinine can any judge get?

Good

In many ways, I am very happy about ICANN's decision. They are recognizing that the internet should not be controlled by politics or a single country/government. If ICANN had blocked the domain, politicans would start to think that they controlled the internet (although some do think that way...)

ICANN says they can't. Is that true?

ICANN's contention seems to be that even if ordered to remove the record, its not technically possible for them. Only the registrar (TUCOWS in this case) could remove the registration.

Is this accurate? Don't the glue records get published through ICANN, and couldn't they remove them?

Of course I am in favor of Spamhaus and against SPAMers...I'm just curious if this is a legal ploy on ICANN's part to help Spamhaus (which I would applaud), or if its just ICANN telling the truth (which I would also applaud...I'm easy to please).

Also, if true, couldn't Spamhaus just move their registrar from TUCOWS (Canada?) to a registrar in a less US court friendly country where any order to remove the registration could be ignored?

ICANN.. well... Can't... but Tucows will have to

Tucows will be subject to the Federal court's jurisdiction, because they maintain business offices in the US (Starkville, MS, according to their website). So if Tucows is ordered to suspend/place on hold the domain registration, they'll be forced to comply.

One Small Victory

Yeah!!!

Will this improve ICANN's profile overseas?

For a while now, the EU and other bodies have been grousing about ICANN being under the control of the US (Dept of Commerce, IIRC). I wonder if this stance *against* a US court will somewhat mollify those objections? ICANN's hardly a US puppydog if it distances itself from the US court system...right? Maybe?

I realize they aren't acting in defiance of a court order (they haven't even been contacted by the court yet, if I understand the press release), but at least they're toeing the "We're independent and neutral" line.

Jurisdiction follows the server, not client

I say that the server location is where courts or governments should have jurisdiction.

The problem is, most people/courts/governments are of the opinion that the server is somehow projecting out to the clients location.

Lets reverse that, and look at it as the client visiting the server. Your web client establishes a session on a foreign server, the server doesn't just randomly broadcast out data to the Internet in general. You have to take the initiative and GET the data.

I'm open to comments here. Is this a horrible idea or does it simplify the mess that we're quickly getting into?

Someone else should register name

Couldn't an independant organization just register the name and direct it to spamhaus's servers? Wouldn't that make it impossible to revoke the domain name?

Make the "People Who Sued Us" list

Here's an idea if Spamhaus ends up deciding to comply with removing e360 from their spammer list.

Create a "People Who Sued Us" list. Make this list functionally similar to the normal ROSKO list, allowing IT admins to choose to use the PWSU list for e-mail filtering purposes. Chances are that anyone on the PWSU list is a known spammer, since only a known spammer would have to resort to shady legal practices to get removed from ROSKO. However, the PWSU list is based only on the easily provable fact of someone suing Spamhaus, meaning that nobody on that list could complain that they were being treated unjustly.

Unlikely to change much

Just an FYI.

In these situations things just keep on coming and coming.

Judges and the judicial system are set up so that court orders can be enforced. Usually against reluctant subjects, so dealing with whiners is not new to them.

Even in civil cases you can get a cop with a gun to go into a business and help you settle things up if the judge orders it. Unless anti-spam people think tucows is going to arm its US office and start shooting people, they are going to comply with this order.

Spamhaus had an easy out, make a special appearance and talk about jurisdiction. Or they could have moved it to federal and fought it on the merits, which would have likely established a positive precedent in the US for voluntary opt-in to these types of published opinion blacklists. Instead they try to game the legal system in the US. That's fine, but they are likely to lose their ability to work within the US by doing so.

spamhaus.org.uk

Spamhaus appear to have been expecting action against their domain name, as on 14 September they registered the domain spamhaus.org.uk, over which US courts have (one hopes) no jurisdiction at all.

I wonder how long ...

Until some l33t hax0rs get into the e360 servers and send a few 100k "not-spams" to the judges offering them ch33p v14gr4.
Or in fact, anyone starts sending them "Special Unsolicited Commercial Email (that-isn't-spam-since-the-judges-ruled-it-wasn't) " for the same ?

Boycott?

I'd say a boycott of any registrar who suspends their domain name. All in favor?

Arms race

There has been an arms race between spammers and admins, in many senses of the word. Spammers learned long ago that they will have an edge if they operate anonymously, either relaying through insecure relays in the old days, or more recently taking control of insecure PCs and servers and operating a fleet of zombie nodes. Their origin is masked. Or they might purchase services through dirty middlemen who then purchase services through dirty ISPs. Either way, spammers try to hide.

But the admins who fight spam often do not hide, usually because they are part of a reputable organization and are well respected by the community, and proud of their work. Also, the way blacklist technology is used (RBL, DNSBL) makes it difficult to conceal who you are. Unfortunately this makes organizations like Spamhaus vulnerable to DoS attacks, harassment, and frivolous lawsuits (remember that spammers call themselves 'internet marketers' and pretend they are legit businessmen). Other organizations like SPEWS are somewhat better at hiding their operation.

There are ideas floating around, however, on ways to harden blacklists agaist attacks of various sorts [sysdesign.ca]. The idea proposed in that 2004 paper would conceal the blacklist publisher, and use distributed resources to serve the list, kind of like how spammers use a fleet of zombies (except spammers steal those resources).

Spammers are a dirty bunch, they fight dirty. Maybe it's time we look more seriously at protecting the blacklists and their operators from various types of 'attacks'.

Illinois Court

Everyone keeps ranting about how the "illinois Court" has no jurisdiction in this place or that place. That's wonderful except,as I understand it,the case was moved to higher court before there was a judgement. So now there is a default judgement in a FEDERAL COURT.....not an Illinois Court so STFU about what an Illinois court can and can't do...maybe RTFA or the other 10 million posts about the story here on /.

Called it! American ICANN isn't a bad choice.

Look, ICANN is an American organization, but notice they arn't bowing to the American courts. That alone should make people happy, this whole case is ridiculous but there's no reason for ICANN or anyone who is providing services to the internet to have to bow to an American judicial system if the offender is in England. At the very least there should be a form of Extradition to take the issue of an internet business before this court, rather then this kangaroo style court.

It might not be great Americans have control of the internet but at the very least we haven't abused it to the point where it has to be taken from us.

Where are the white hats?

Why doesn't someone just crush e360 with a super DOS attack on their servers?

My feeling

Spam is bad.

E360's Insight

It took me a while to find E360's site [e360insight.com], as it has a PageRank of 0 (compared to Spamhaus' 7). Interestingly, the site has no content other than a record of the case, highly biased:

This ruling confirms e360insight's position that Spamhaus.org is a fanatical, vigilante organization that operates in the United States with blatant disregard for U.S. law. In addition, e360insight has proven that Spamhaus routinely exposes their customers and volunteers to extreme legal risk by continuing to engage in improper blacklisting, defamation, extortion and blackmail in the name of fighting spam. Importantly, this ruling clearly establishes the validity of e360insight's legitimate business practices as a responsible, opt-in marketer.

If you are a responsible, permission marketer doing business in the U.S., you are free to use the information on this website, our documents, legal strategy or Synergy Law Group to pursue a case of your own against Spamhaus or any other improper blacklist organization that is damaging your legitimate business.

ICANN can't

I believe this has a lot to do with net neutrality as well. If ICANN pulls the plug they would be violating it.

It probable would not work, but :-)

What if SpamHaus, in order to avoid being in "comptent" would decide "unilaterally" to stop providing their services to US customers.
Maybe it would have an sufficient effect to make "someone" notice.

And after dusting off some old fax machine or uucp modem/software the power that be would make a "friendly visit" to e360.

On the other hand, I'm not sure that 4* more spam would actually be such a drag on the Internet, I do every morning my "religious duties" (show unread message, alphabetically sorted, erase bunch of similar junks) and having 4* more would probably not significantly slow me down.
As for the overal bandwith, I suspect that with the popularity of video blogs, and community sites, the percentage dedicated to mail went significantly down.

Therefore I believe it is fundamentally not an issue of efficiency, or method, but only an issue of what rights are the US claiming over foreign content providers on the Internet.

Either the US claim that: I do not like that site that is visible on the Internet it has to either GO or be Invisible.
In that case there is no moral difference between the US and Chine/Saudi/Iran (choose your favorite "contry wide firewall manager"), at least on the "right to information".

Or they have to go sue a site that they do not like IN THE COUNTRY WHERE IT IS "really" OPERATING (ther really part can be quite tricky if it is a money gaming site incorporated in eastern molnavia, with a gaming server in denmark, a payment platform in Turkish Cyprus and a virtual cash server in the bahamas.)

And accept that some country just might have laws that differ from the US laws.

Excellent Posting from SecuriTeam Blog in Response

Taking what law into their own hands? Please show us the code chapter that requires that mail servers accept mail from all comers, with no right to block mail. A mail server is private property, and as such, the owner is not breaking the law when he/she chooses not to accept mail from a specific party. If the owner decides to delegate that decision making to another person, that's their right, as well. There has grown up around the world the misconception that email is a right, and that service providers and mail server owners cannot interfere in the right of others to send any message that they choose. It surely sucks that you're finding it hard to make a living by sending special marketing emails. But that's life. I'm also not going to allow you into my house. So sue me, demand your right to enter my house at will and leave your marketing materials on my coffee table. I dare you. Comment by Dave -- October 7, 2006

Re:IANAL - Translation

There is some other good news here. Suppose Tucows is ordered to, and does suspend spamhaus.org, all Spamhaus has to do is use (or register) a domain registered through a non-us based registrar. We'll have to update our RBL rules, but it will continue to operate, and the US court won't be able to interfere.

You don't get it do you

So what do you think the judge should have done in this case, given that the defendant gave the court de facto jurisdiction and then failed to make an appearance? If you fail to follow courtroom procedure and get censured for it, that's your own damn fault (in this case Spamhaus). Besides, if the judge does use e-mail, I'm sure the judge also knows what spam is.

But keep raging against the machine.

Re:Please let me know the address of the judge

The judge made the right decision.

It's an adversarial system. If there's no defendant, the plaintiff wins. Blame the law. Not the judge.

Try snail mail

Better yet to send snail mail to the judge. Seeing how he's ruled on this case, I doubt he would even have an email address.

Re:Please let me know the address of the judge

What did the judge do?

I just glanced over the thing, and it says that at a certain point Spamhaus' laywers stopped showing up to court, so the judgement defaulted to the plaintiff. I'm pretty sure the judge didn't have a lot of leeway to do any judging at that point.

(oh yeah, great job using "mail", "judge", and "bomb" together - enjoy being an enemy combatant... ah crap! I'll see you at Gitmo...)

Re:Please let me know the address of the judge

The judge is just following the law, and, indeed, the constitution. This has nothing to do with "freedom of speech". Spamhaus asked for a civil suit to be moved to Federal Court, and then failed to defend themselves. Wham. Default judgement.

It doesn't matter whether Spamhaus is being sued for describing Ted Kaczynski or "Spamford" Wallace as a spammer. It doesn't matter if this is Spamhaus or SPEWS. It doesn't matter if spam is a nuisance or welcomed by millions of people across the world. They failed to turn up. They're subject to a default judgement and legal sanctions to prevent them from continuing the offense.

That's what the law and constitution says is the correct response, and therefore, while it might be unpopular, this is the correct thing for the judge to do. For all the criticisms of judges "legislating from the bench", it seems that the majority of people would rather they do that than follow the law. (Witness SCOTUS's response to the Connecticut eminent-domain thing. For some reason, everyone decided it was SCOTUS at fault. The real problem was a vague phrase in the constitution, an out of control local government, and state and Federal legislatures who'd failed to impose legal limits. But everyone blamed the judges.)

The judge needs to follow the law, even when it's unpopular. The legislature needs to be told to deal with this fiasco. And Spamhaus needs to be more careful and less stupid and contradictory in their ways of dealing with courts.

Free Speech

It is interesting that you think you don't have the right to shout fire in a theatre. You do have the right to do it, in fact you have the right to say anything you want to. But, you have to deal with the results too. With rights come responsibilities. Shout "Fire" in a theatre, and if there's no fire, bad things will likely happen to you. Say something about someone with malicious intent and you can be sued for libel. You're perfectly free to do those things, but there are consequences because we as a society have decided that some speech in certain cases is not acceptable and therefore, there will be consequences.

e360 is annoyed that they are identified as a spammer. Tough noogies. They have the right to send as much spam as they want; well, I have the right (and according to my boss, the responsibility) to shut them down. If e360 wanted to pay us for the time it would take our users to sort through their spam, I'm sure we could come to an acceptable agreement, but, unless they accept responsibility for their actions, I have to and the solution to that is to block their mail.