Major Anti-Spam Lawsuit Filed in Virginia

By Brian Krebs Staff Writer
Thursday, April 26, 2007; 2:31 PM

A company representing Internet users in more than 100 countries today filed a lawsuit in Virginia seeking the identity of individuals responsible for harvesting millions of e-mail addresses on behalf of spammers.

The suit was filed in U.S. District Court in Alexandria on behalf of Project Honey Pot, a service of Unspam Technologies LLC, a Utah-based anti-spam company that consults with private companies and government agencies.

The lead attorney on the case, Jon Praed of the Arlington, Va.-based Internet Law Group, has represented America Online and Verizon Online in successful cases against junk e-mailers. Praed said the group hopes to follow the trail from the people doing the harvesting of e-mail addresses to the actual spammers.

"It is clear that the key to stopping spam is identifying those responsible for it, and getting that information into the hands of those capable of doing something about it," he said.

The Virginia court has been the venue of choice for a number of previously successful anti-spam cases filed by some of the world's largest Internet service providers. But this is thought to be the first anti-spam case brought by a class of Internet users not affiliated with any single Internet service provider.

"This isn't just some [Internet service provider] trying to get good press, this is a community of Internet users saying we're sick and tired of this crap and we want it to stop," said Matthew Prince, Unspam's chief executive officer.

The company filed the suit on behalf of some 20,000 people who use its anti-spam tool. Web site owners use the project's free software to generate pages that feature unique "spam trap" e-mail addresses each time those pages are visited. The software then records the Internet address of the visitor and the date and time of the visit. Because those addresses are never used to sign up for e-mail lists, the software can help investigators draw connections between harvesters and spammers if an address generated by a spam trap or "honey pot" later receives junk e-mail.

Spam recipient lists typically are generated by automated programs that scour the Internet for e-mail addresses. Similarly, the sending of spam is also automated, as the bulk of junk e-mail is routed through compromised personal computers to mask its true source.

In many cases, those responsible for harvesting e-mail addresses are not the same people sending the spam, but rather individuals who will sell the lists to known spam operators. Project Honey Pot also has found that in a great number of cases, e-mail harvesters do not appear to try to hide their Internet addresses.

"We've found that the Internet addresses of those doing the harvesting is a much smaller universe of those who are actually sending the messages, and locating [the harvesters] may give us good indicators of who out there is at the top of these spam operations," Prince said.

The suit filed today names defendants as "John Doe," meaning that the plaintiffs will ask the court for the authority to subpoena records from ISPs to verify the identities of owners and operators of e-mail harvesters.

The federal court in Alexandria is known for its expertise in adjudicating anti-spam cases, but the plaintiffs also chose that location because evidence points to a great deal of spamming activity emanating from Virginia. According to the complaint, since January 2005 the project has identified more than 15,000 unique Internet addresses associated with e-mail harvesting activity, 22 percent of which were located in the United States.

CONTINUED     1        >

© 2007 The Washington Post Company