Spam Kings (29 page)

Buried within the dense language of the CAN-SPAM Act was an unusual enforcement
provision overlooked by many people. Under the new law, the FTC was required to consider a
bounty system for those who tracked down illegal spammers. The authors of CAN-SPAM proposed
rewards of "not less than 20 percent of the total civil penalty collected" by the FTC.
Lawmakers gave the agency until September 2004 to report back on the plan's
feasibility.

The idea of paying monetary rewards to anti-spammers was spawned in September 2002 by
Lawrence Lessig, an Internet visionary and professor at Stanford Law School. In an op-ed
piece, Lessig suggested that spam would abate if the government required spammers to tag
their messages as such and forced spammers who don't label their junk email to pay $10,000
to the first recipient who finds them.

"If we deputized the tens of thousands of qualified people out there who are able to
hunt offenders, then a large number of offenders would be identified and caught," he
wrote.

Lessig believed so strongly in the concept that he staked his job on it. In January
2003, he publicly stated that he would resign his position at Stanford if a spam-bounty
system became federal law and did not substantially reduce the level of spam.

Lessig's stunt worked. Lawmakers slipped the bounty provision into CAN-SPAM at the
eleventh hour. With the passage of the bill, capturing a spammer's hide had become a
potentially lucrative pastime. Yet few anti-spammers rejoiced at the opportunity. Steve
Linford pointed out to journalists that Spamhaus and other organizations already had plenty
of information about spammers. The problem, he said, was getting prosecutors to act on
it.

Shiksaa didn't give much thought to the prospect of a career as a spam bounty hunter.
She had never been driven by financial motives. Instead, she believed that her online
activism would be its own reward. Yet as Shiksaa entered her fifth year of spam fighting in
2004, she resolved it would be her last.

Shiksaa would never admit it to the spammers, but the events of the past nine months
made it clear she was locked in a losing battle. For all her efforts, the spam problem was
getting worse, and it was messing up her life in the process. Back when she was getting
started, Shiksaa had thought spammers were simply misguided people who would respond to
reason. Put a few on the right path, and the tide of spam would ebb. She knew better now.
Spam had become organized online crime. The spammers operated in little cartels, with their
private spammer forums and closed mailing lists. They knew what they were doing was
unethical, but they were too arrogant and antisocial to care.

And some, like Richter, were also savvy enough to give CAN-SPAM—and maybe even the New
York and Microsoft lawsuits—the slip. In essence, CAN-SPAM was a truth-in-sending law; it
removed spammers' ability to lie about who sent their email. As such, it would create few
problems for Richter, who relied much less on anonymity than other spam kings. As Shiksaa
saw it, Richter's business was built around a simple premise. Millions of people on his
lists were too busy or too computer illiterate to unsubscribe from—let alone complain
about—spam. Richter had built his wealth on the small percentage of people gullible enough
to buy whatever junk he was offering.

Shiksaa certainly didn't owe Scott Richter any favors. But in January 2004, Richter's
dad asked her whether she'd sign an affidavit regarding Dustin Parker, the young computer
expert who had deserted OptInRealBig.com LLC. Steve Richter wanted her to testify in writing
that Parker had provided her with proprietary company information. He said it was necessary
to his son's lawsuit against the former employees.

Shiksaa replied that Parker had merely given her instant-message logs. But she agreed to
sign an affidavit to that effect.

"I'm not doing this for him or for you," she told Steve Richter. "I'm doing it because
it's the right thing to do."
^[
4
]

As the year 2004 unfolded, Shiksaa kept a much lower profile. She avoided heated
confrontations with Richter and other spammers over AIM. She couldn't give up on Nanae
altogether, but she went long stretches in "lurk-only" mode, reading but not contributing to
the discussion. She continued to hang out on #Lart, the Internet relay chat channel popular
with her close anti-spam associates. But spam was no longer a crusade. She had certainly
lost the desire to poke spammers with a sharp stick just to see how they'd react.

To that end, Shiksaa removed almost all of the files from Chickenboner.com
. She took down pages displaying the various photos parodying Andrew Brunner,
Bubba Catts, Rodona Garst, Davis Hawke, Bill Waggoner, and others. Shiksaa also removed the
"Bulk Barn Diaries"—her log files of conversations with Richter, Dr. Fatburn, and other
spammers. She had begun cleaning house back in the spring of 2003, after Mark Felstein sued
her and the rest of the Nanae Nine. But now the site was totally spartan.

About the only thing Shiksaa left on her site was the big "Uncle Sam" cartoon on the
home page. Like the World War I recruiting poster, the image at Chickenboner.com showed a
gray-haired man dressed in red, white, and blue, pointing at the viewer. But an anti-spammer
had doctored the image to give the personification of the U.S. government a wooden mallet in
his hand. Beneath Uncle Sam were the words, "The Lumber Cartel Wants You."

Davis Hawke spent Christmas Day 2003 at his parents' home in Medfield, Massachusetts. He
and Patricia drove up from Rhode Island in his Crown Victoria with their two wolves in the
backseat. (Hawke had brought Patricia along on an invitation from his mother.) He was antsy
from the moment he pulled into the Greenbaums' long driveway.

Hawke had intermittently been in touch with his father since dropping out of college.
But he had only recently mended ways with his mother. They had tacitly agreed not to talk
about his neo-Nazi period. But she made it clear she didn't approve of his spamming either.
The thought of spending several hours in her home filled him with dread.

To break the ice, Hawke presented his mother with a gag gift soon after he arrived. It
was one of the Truster portable lie detectors he had been spamming for a couple months. He
explained that the handheld unit worked by measuring the stress levels in a person's voice.
Israel's Mossad security service, he told her, used a similar device to interrogate
suspected terrorists. Peggy Greenbaum didn't even take the Truster out of its box. But he
could tell she was pleased to learn he wasn't just selling penis-enlargement pills.
^[
5
]

After lunch, they all took the dogs (his parents had a Husky mix) for a stroll through
the woods to a nearby pond. It was unusually mild for December, with temperatures in the
fifties. As they scuffed across the remnants of snow on the ground, Hawke's mother posed a
question.

"Britt, you say you have such a huge business, but why aren't you on the list of the top
spammers?" she asked. Mrs. Greenbaum had recently done an Internet search and found the
Spamhaus Rokso page. Aside from Patricia's mink coat, she saw little evidence that her son
was as wealthy as he claimed.

"Ah, but that's the mark of my success," Hawke replied, not certain whether she was
criticizing or just teasing. He explained that getting blacklisted on Rokso made life very
difficult. He said his strategy was to keep a low profile and quietly get rich without
attracting attention.

Then Hawke told his parents about how he and Bournival were about to launch a major new
project. In the coming weeks, he said, they planned to interview several hundred people up
in New Hampshire and build a new customer service center. He couldn't tell them much, except
to say it would make millions of dollars.

"They're going to want to interview me on
Larry King Live
," said
Hawke. But just to be safe, he told his parents, he would continue to rent rather than buy a
house, and he would drive second-hand cars.

"You can't own assets in this business," Hawke said.

That was just fine with the Greenbaums. They would have preferred if their son were a
doctor or a lawyer. But their moral objections to his choice of career were softened by his
pragmatic approach to the business. In any case, they considered spamming a lot better than
what he had been doing previously.

When everyone returned from the walk, Hawke told his parents he needed to head out. He
said he wanted to get up to New Hampshire right away, so that he and Bournival could begin
what would probably be a two-week process of launching the new operation. It disappointed
the Greenbaums to see their son leave so soon, but they were happy he seemed so energized by
his work. He promised to send them updates by email.

A few days later, Hawke pulled up with a rental truck at the loading dock outside
Amazing Internet Products's office in Manchester. He wasn't there to unload telephone
headsets or chairs or desks for the hundred new employees he'd told his parents about. Hawke
was just claiming his half of the company's forty-plus computers and inventory of
pills.

Hawke didn't want to upset his parents at Christmas by revealing that his new project
had actually stalled out a few weeks previously, when he and Bournival decided to dissolve
their partnership.

The big plan would have involved sending a new form of spam aimed at mobile phones.
Hawke and Bournival had discovered that most major cellular-phone providers in the United
States operated Internet gateways for forwarding email to subscribers' phones. Few cellular
customers in the U.S. used the feature, known as short message service (SMS). But all the
carriers had nonetheless set up millions of email addresses with subscribers' ten-digit cell
phone numbers as their account name (e.g.,
[email protected]
).

At first, both Hawke and Bournival saw an excellent opportunity to target the cell-phone
gateways with automated spam attacks. They could configure their spam programs to latch onto
a provider's domain and pepper it with area codes, prefixes, and number combinations that
might be valid for the particular provider. (To spam Sprint PCS
in Dallas, for example, they'd start with [email protected],
and then hit 2144170001, and incrementally work their way through all the possible phone
numbers.)

While SMS spamming
was common in Europe and Asia, Hawke believed the U.S. market was still waiting
to be pillaged. Very few U.S. spammers knew how to mass-broadcast SMS messages. At the same
time, he figured most cell phone carriers in the country had poor safeguards to prevent
spamming compared to regular ISPs. Even better, as far as Hawke could tell, the CAN-SPAM
laws did not apply to cell phones.

But Bournival came to doubt whether SMS spams would actually produce sales. The
technology limited messages to a scant 160 characters. Besides, they couldn't contain
clickable hyperlinks, so the spams would need to include a toll-free number or a web site
address. Bournival argued that most recipients would be annoyed by the spams, and those who
weren't would be too lazy to seek more information.

At the time, Bournival had generally lost patience with Hawke as a partner. Hawke's
impulsiveness and sloppiness grated on him. Plus, their 50/50 revenue split seemed unfair
given how much more work Bournival was doing. (Having access to Hawke's unlimited merchant
account seemed irrelevant when business fell off the previous autumn and they were taking in
only a few thousand dollars a month.) After agreeing they could each make more money
spamming solo, the two decided to divvy up their computer equipment and inventories and go
their separate ways.

Hawke and Bournival stayed in regular contact. But while Bournival started 2004 without
any major New Year's business resolutions, Hawke was busy setting up an office to house his
new firm, the Phoenix Company. He arranged to rent the top floor of a three-story office
building on Main Street in Pawtucket, overlooking the Seekonk River. The office occupied
over 5,000 square feet in the modern, brick building. Hawke's new crew consisted of Mauricio
Ruiz, Mike Clark as technical guru and spamming affiliate, and Jacob Brown—a young guy he
met on the Pawtucket tennis courts who had previously been working as a waiter—as office
manager. Hawke also hired several young women—most of them friends of Mauricio's—to handle
customer service. At one point, Hawke transferred the registrations of hundreds of Amazing
Internet Products domains to the Phoenix Company and listed Ruiz as the owner of the
domains.

The Phoenix Company started off spamming some of Hawke's old standbys: the Truster lie
detector, the Banned CD, and Pinacle penis pills. Then, in late January, when Hawke heard
the FDA had announced a ban on ephedra
sales effective April 12, he cooked up an idea for a new spam campaign. Hawke
arranged with Certified Natural
to private-label ephedra pills under the RaveX brand. The name was a reference
to "raves"—high energy, all-night dance parties that feature loud techno music and often
involve drugs such as Ecstasy and methamphetamines.

Hawke's RaveX web sites, designed by Certified, featured a pink-and-black illustration
of a young woman dancing wildly. Beside her in white type were the words, "Pure Ephedra. Buy
It While It's Legal." Despite reports of several deaths linked to ephedra, Hawke's spams
touted RaveX as an "all-natural stimulant" and claimed it was safe.

"Over-the-counter medicines such as aspirin and Nyquil are far more dangerous than
RaveX," said Hawke's spams.

To increase his odds of getting his spams into AOL, Hawke switched to a new program
called Dark Mailer
. Developed by Russian programmers, Dark Mailer was pricey, selling for around
$500. But the program gave spammers unprecedented power to manipulate their email message
headers, even though doing so was illegal under CAN-SPAM. Through trial-and-error testing,
Hawke quickly discovered ways to tweak his spam and penetrate most ISP filters, including
AOL's, pretty much at will.

Meanwhile, Bournival was trying to comply with CAN-SPAM just enough to stay out of legal
trouble. He began using valid "From" addresses in all of his spams and always included
instructions on how recipients could opt out of future mailings. But Bournival was reluctant
to list his mailing address in the spams, as required by the new law. And he still relied on
Super Mailer, which illegally used proxies, to send his messages. In order to further
differentiate his mailings from Hawke's—who was paying no attention to CAN-SPAM—Bournival
arranged with Certified Natural to provide him a new, private-label brand of penis pills.
Soon, he was spamming emails for Sizer XXX.

Bournival did pretty well without Hawke or his merchant account, although he certainly
was at no risk of maxing out his $25,000 processing limit. Nor was he making enough to
consider an offer he got from Alan "Dr. Fatburn
" Moore to take over his order processing. Fatburn had been repeatedly pestering
Bournival by phone and instant message to outsource the function to him for a flat fee per
order. Bournival figured Fatburn was just hungry for cash now that he had been sued out of
the spamming business. But something about the offer made him suspicious. Bournival wondered
whether Fatburn was simply trying to lure him into a trap, as part of the settlement
agreement he had signed with AOL in December.
^[
6
]

Come February, the Phoenix Company
's profitable spamming run temporarily hit the skids. As was its habit, AOL had
fine-tuned its spam filters, and suddenly RaveX spams were not getting through. Ruiz and
Clark went back to the drawing board, in hope of tweaking the messages so they would slip
by. But Hawke decided it was a perfect time for him and Brown to dust off the abandoned
cell-phone spamming project.

The first task was to create mailing lists. The two men scoured the Internet to find
information about the various six-digit area code and prefix combinations in use by cell
phone carriers. They could find nothing comprehensive, so they began manually compiling
lists based on cell phone numbers of friends and relatives. Then they moved on to
extrapolating from cell phone numbers they found published on the Web.

Next, Hawke and Brown sent test spams to Brown's Verizon Wireless cell phone and Hawke's
Sprint PCS phone. They were surprised to discover the carriers apparently had rudimentary
filters in place. After some experimentation with the content and headers of the messages,
they were able to get most of their spams through.

At that point, late February 2004, Hawke and Brown began pounding out millions of RaveX
ads to Verizon Wireless and Sprint PCS addresses.

To stay under the SMS message limit, Hawke included just a subject line ("Banned in 30
days?") and a short message body ("Get EPHEDRINE now! Guaranteed to work or your money
back!"). The messages also listed one of the several toll-free numbers Hawke had set up.
Spam recipients who called the number heard a sixty-second advertisement recorded by one of
Hawke's female employees. Listeners who lasted until the end of the recording were
instructed to press 2 on their phone keypad to place an order, or press 1 to
unsubscribe.

Cell phone customers, it turned out, were even more hostile toward spam than email
users. Irate recipients phoned the Phoenix Company's toll-free line and vented at the
handful of people Hawke had hired to handle calls. Others jammed the voice mail system with
angry messages. Hawke managed to take in only a couple dozen orders before the phone company
shut down the toll-free line. In the first week of March 2004, local papers in Oklahoma and
North Carolina ran articles about residents who had been roused from sleep by their beeping
cell phones, only to find messages advertising ephedra.

The plan that had looked so good to Hawke on paper proved to be a disaster. But Hawke
wasn't ready to give up on SMS spamming just yet.