E L E C T R O S P H E R E    Issue 2.03 - March 1996

Spam King! Your Source for Spams Netwide!

By Simson Garfinkel



Do The Euphoria Tape alone the first time, and then with a lover. It's a phenomenon you will feel within the first 3 minutes of use - what you feel the rest of the time is unbelievable

- Worldwide spam, October 1995

Back in Jeff Slaton's early days, it was easy to tell if he was behind any given worldwide spam of the Usenet: all of his spams came from New Mexico. It didn't take long for the vigilantes on the Internet to swing into action. Within a few hours of Slaton's first spam, the name and phone number of his access provider were published on the Usenet group news.admin.net-abuse.misc. People were advised to call or send e-mail to the Albuquerque firm, Rt.66, and voice their opposition. A few days later, Slaton's first account with Rt.66 was yanked.

Spamming is the now-familiar practice of deploying mass postings to Usenet and sending blanket mailings to Internet lists, and Jeff Slaton was poised to make a buck by selling his ability to do it. But the weekend after Slaton's first "blast," or all-out spam, Rt.66 got more than 1,300 complaints. "He is no longer a customer," says Bob Kelly, Web designer for Rt.66. "We will not take his money." Slaton's offence: abusing the Net.

Thrown off his first service after burning through several assumed names, Slaton set off on a seemingly endless sequence of comebacks, signing up with one of Rt.66's Albuquerque competitors, Internet Direct. But Kelly called Internet Direct to warn them, and the next day, Slaton's new account was axed as well.

That's the way Usenet has always dealt with spammers. Mail crusades. Intimidation. Harassment. The old-boy network. The technique is simple, if legally questionable. Simply publish the spammer's real name, home phone number, and address. Publish the name of his or her access provider. If everybody on the Internet who is offended by the spamming sends a message complaining about the apparent abuse, the resulting flood of messages will effectively put the spammer's computer - or his provider's computer - out of commission.

Such intimidatory tactics have worked before. In 1994, lawyers Laurence Canter and Martha Siegal spammed Usenet with ads offering legal assistance with the US Immigration and Naturalisation Service's "green card lottery." Tens of thousands of people sent complaints to Canter and Siegal's service provider, causing its machine to crash. Within a few days, their provider shut them down rather than risk a repeat, and after a few more spamming attempts, Canter and Siegal decided to back off and write a book about their exploits instead.

But this "Revenge of the Net" isn't working with Slaton, who has dubbed his business Spam King. Slaton's not put off by the ire - in fact, it goads him on.

"I've been blacklisted across the nation," says the Spam King, laughing from his home in Albuquerque. "It is very difficult for me to get an Internet service provider to put me on, because they know what my agenda is." Instead, he's devised a much better approach: "I have people set up their own Internet service accounts. They give me their login and password, and then I launch my program."

Meanwhile, a group of Usenet news administrators and self-appointed network vigilantes have assembled a comprehensive profile on the spammer in recent months. They have posted his social security number, home telephone number (+1 505-821 1945), even the number in his kitchen (since disconnected). They have posted the name of his employer (U S West) and his supervisor (Judy Jaramillo), and her phone number as well (+1 505-828 9313). The message from these posters, while never explicit, is obvious. Cause trouble for Slaton. Destroy his credit. Get him fired from his job. Call him day and night. Punish him for sullying the Internet.

Still, it's not working.

"This is a for-profit, commercial enterprise," says Slaton, describing his spam-for-hire business plan. "I'm doing about 15 spams or mass postings a week. All of a sudden, there has been an absolute crush of demand for my service." And at US$425 (£266) "per insertion," as he calls them, that adds up to more than $300,000 (£200,000) per year.

Calls to U S West, where Slaton used to sell ads in the Yellow Pages, are useless: Slaton is on extended leave. And as for angry Netters publishing his home phone number, he sees it as free publicity: every time his phone number is posted, his business grows.

Slaton has even fuelled the flames himself. Late last year, he tacked a special offer onto one spam: get your e-mail address removed from his database at a cost of $5. "That was actually a hoax," Slaton confesses. "It was designed to stir up the beehive, to create controversy."

And Jeff Slaton's not even worried about someone showing up at his door carrying a big stick. "My friends Smith & Wesson," he says, "are very prepared to talk."

I have a friend who just retired as the Associate Director of Los Alamos Natl Labs in New Mexico. We worked together to obtain the plans to the FAT MAN & LITTLE BOY Atomic Bombs. (Unique commemorative, declassified and "just" released!) This is a "must have" for anyone interested in Science or History...

- Jeff Slaton's first spam

Slaton started spamming in July of 1995. After picking up a copy of Canter and Siegal's book, he asked the folks at Rt.66 if they would mind if he spammed an advertisement from his account. Bob Kelly would have nothing to do with it. "We said, 'Listen, this is not the way to do it. Why don't you go read a real book about making money on the Internet instead of just being an asshole?'"

But Slaton had better plans. According to Rt.66, he let his monthly fee with the company lapse. Then, three days before the provider would have cancelled his account for nonpayment, Slaton sent out his advertisement. The advertisement went everywhere. It went to Usenet groups that might welcome the information, like sci.energy and rec.pyrotechnics. It went to groups that had nothing to do with the subject, like comp.os.msdos.4dos and sci.math. And it even went to groups where the message might be considered totally out of line. "One of the places he advertised his blueprints of nuclear bombs was a brain tumour support group," says Kelly.

Slaton showed no remorse. "I'm a charter member of the National Atomic Museum. The authentic reproductions were very high quality. Dr. John Hopkins was the associ- ate director of Los Alamos National Laboratory. He thought it was a good idea." At $18 each plus shipping, Slaton says, "We sold thousands and thousands of them all over the world."

Looking back, Slaton says he'd taken the Canter and Siegal idea "up about 100 notches." And from there? He began advertising his own enterprise.

From: SpAmKiNg@505-821-1945-new.LOW.rates!! (YOU TO CAN SAVE$>>>) Subject: Let Us Help You Spam the Net! SPAM KING HAS NEW LOW RATES! POST TO LIST SERVE MAILING LISTS. DIRECT E-MAIL. AND NEWSGROUPS! REACH 6 MILLION+ INTERNET SUBSCRIBERS! CALL 505-821-1945!! MASSIVE SPAMS! WE CAN SPAM AS MANY AS 7000 NEWSGROUPS AND MAILING LISTS AT ONE TIME, SO THAT ALL SEE YOUR MESSAGE AT ONCE. CALL US TODAY AT 505-821-1945. WE WILL SEND YOUR FIRST SPAM OUT FOR FREE TO SHOW YOU HOW WELL WE CAN DO THE JOB.

One of the ways Slaton has improved on Canter and Siegal is by going beyond the massive Usenet postings to aggressively spam mailing lists and individuals through the use of e-mail. "I have the technology and the capability," Slaton boasts. "I can reach 6 to 8 million people." Did you receive a note in your mail queue from Scott Glasrud, who was running for local office in New Mexico? Did you get the message last October selling The Euphoria Tape? Have you downloaded ads for Compass International Telecom of Boston? If so, then you've been hit by a piece of Slaton's flying spam.

For Slaton, collecting the addresses isn't a problem. One of the easiest ways, he says, is culling them from Usenet itself: many people sign their posts with their addresses. But an even more effective way to spam, the expert explains, is by sending mail to professional and special-interest lists.

In one sense, this is target marketing gone mad. Before the Internet, it was in advertisers' best interest to 'target' the people who received their ads. After all, there's no reason to spend the money to send denture cream advertisements to high school students. But in the crazy world of Internet economics, Slaton explains, "it's just as cost-effective for me to send to 6 million e-mail addresses as to 1 million e-mail addresses, so why bother being selective?

"In fact, prequalifying a prospect is a dangerous thing, simply because you might well miss a whole group of people who are out on the fringe."

Increasingly, Internet mailing lists are closed to prevent this sort of abuse: some mailing lists will allow only members of the list to post, and others are set up to accept mail from a moderator only. But Slaton scoffs at such technical solutions. "It's a band-aid approach," the Spam King argues. "It makes it a little more challenging for somebody who's committed."

Patrick Townson, editor and publisher of the Internet Telecom Digest, asserts that Slaton has another way of getting addresses: by taking them. "He broke in here and sent a lot of nasty messages to my mailing list and my newsgroup," Townson says. According to Townson, Slaton was able to obtain a complete subscriber list using a relatively obscure feature in sendmail, a Unix mail utility primarily used by sysadmins, and then sent his ads directly to readers, bypassing the moderator.

Slaton denies breaking into the Telecom mailing list: "Totally untrue!" he says. "I am not a cracker. I have no use for his subscriber list as I have many times more e-mail addresses on my database. Why would I waste my time?"

But Townson went to battle. He published Slaton's voicemail number several times, republished his Social Security number and other information, and suggested that if Slaton saw no problem with irrelevant messages going out over the Net, "perhaps he would see no problem with irrelevant messages going to his voicemail. I took the logic," gloats Townson, "and put it in reverse."

Subject: I am responsible for The Euphoria Tape. I wish to discuss the terms of my surrender.

- Spam King customer, Telecom Digest, October 24, 1995

When attacks only made Slaton's spamming more steadfast, indignant Net users went after his customers. The Internet, after all, was turf worth protecting from a potential onslaught of junk mail.

Once again, however, Slaton seems to have dodged, advising his customers not to include their electronic addresses in ads and to set up their own voicemail boxes. "You can use this phone number in your advertising and then disconnect it in the future," Slaton says, "without ever compromising your true number."

The customers who seem happiest with the Spam King's work are those who are not directly involved in the Internet and see it only as a means of promoting their product. "You cannot beat $425," says Ralph Seebach, president of California-based Amelox Incorporated. Last fall, Seebach read an article about Slaton in the San Jose Mercury News, then badgered the paper to get a contact number. The reason: Seebach wanted to advertise his $40 program designed to tutor junior college students on real estate, and though Slaton's number is plastered all over Usenet, Seebach didn't have an Internet account to find it.

True, Seebach admits, he knew spamming would challenge his company's reputation. But he didn't care - he believed the sales leads he'd gain would outweigh any harm. "I understand," he insists. "The only problem is, how do you get junior college students? Unless you get national coverage, it's almost impossible."

And Seebach is just one of many. After the Mercury News article was published, the paper received dozens of phone calls from readers looking for the Spam King. Indeed, Slaton reports business is going so well that he's getting his own site on the Net, complete with his own T1, tapping straight into the network's backbone. "The business is going to have a little more respectability than what I'm doing currently. It will involve more of the national accounts like MCI and Chevrolet," says Slaton, though he declines to name any contacts. "I've been in conference with them already, and they're showing interest."

Don't expect to see spams for MCI or Chevy any time soon, however. According to Slaton, these companies don't want "the entire blast," but are instead interested in segmenting the Internet, sending their ads only to people who want them. Meanwhile, Slaton says, he has started sending out surveys of those he has spammed, so he can build a demographic database and "segment my list" to accommodate his clients' needs. Imagine.

"Business will continue ... but with a twist," says Slaton, who announced at the Comdex trade show in November that he would cease spamming Usenet and would allow people to remove themselves from his list of direct e-mail solicitations free of charge. Slaton also said that he would be setting up his own electronic newsletter. But whether Slaton really stops spamming - or simply stops signing his name - may be difficult to determine.

The Telephone Consumer Protection Act of 1991, 47 USC § 227(b)(1): It shall be unlawful for any person within the United States - (C) to use any telephone facsimile machine, computer, or other device to send an unsolicited advertisement to a telephone facsimile machine...

Is anything about spamming actually illegal? "US Code 47 says it's illegal to send commercial solicitations to a facsimile machine," says Robert Raisch, an 18-year veteran of the Internet and founder of The Internet Company in Cambridge, Massa- chusetts. "A fax machine is defined as any machine that connects to a telephone line and can render on paper."

Perhaps that covers a computer and an electronic mail system, but Raisch isn't sure. That's why he is working with a small group of people developing model legislation for US Representative Edward Markey, a Massachusetts Democrat who sits on the House Telecommunications Subcommittee. That legislation would make it illegal to send out unsolicited commercial e-mail.

"It's postage-due marketing," complains Raisch, referring to the hourly-rate costs of downloading unwanted material. "It's really kind of disappointing to see that the only way people like Slaton can find to make money on the Net is fundamentally stealing from others."

Others counter that increased legislation of the Net is precisely the wrong way to protect it. "It's premature to say we need laws on this," says Robert Smith, publisher of the Privacy Journal, a Providence, Rhode Island-based newsletter which has been following the impact of computers on privacy for years. "One of the good things about the Net is that it's free of bureaucracy and regulation. It's self-governing unlike any other institution I know of. Users of the Net will figure out a methodology to combat this."

And he may be right. The Net is a wily, inventive opponent, and even if the network is regulated, it would be difficult to stop spammers based in the Netherlands or Tokyo. Besides, if spammers like Slaton, and people who hire them, get enough of the Net's special brand of harassment, perhaps no reputable business will risk it.

Or perhaps that's wishful thinking.

Offering up a gold mine of 6 million potential consumers, Jeff Slaton isn't just selling spams; he's selling dreams.

Simson Garfinkel's new book, Practical Unix and Internet Security, is published in the UK by International Thomson Publishing.

For more information:Who Is "Spam King?"
Blacklist of Internet Advertisers
"Postage-Due Marketing: An Internet Company White Paper ", by Robert Raisch.