From the July 19, 2002 print edition

More Print Edition Stories

EarthLink wins $25 million lawsuit against junk e-mailer

EarthLink Inc., the third-largest Internet service provider in the country, has been a staunch advocate of online privacy and has even run advertisements promising to go after those who abuse it.

On July 9, the company (Nasdaq: ELNK) won a $25 million judgment against one of the most notorious and active "spammers" that used the company's network to send an estimated 1.25 billion junk e-mails since 2000.

It is believed to be one of the largest, if not the largest, fraudulent spam judgment since the Internet was created. The judgment also reinforces EarthLink's commitment to keeping its customers' online mailboxes uncluttered, said Karen Cashion, assistant general counsel for EarthLink.

"When we're able to put a spammer out of business, as we did in [this] case, it helps to improve the quality of Internet service," Cashion said. "Our ultimate goal is to protect customers in situations where we have spammers. It's extremely important to us."

Judge Orinda D. Evans of the U.S. District Court for the Northern District of Georgia granted EarthLink a $24.8 million judgment against a Tennessee man who, according to a lawsuit EarthLink filed in August, used stolen credit card numbers and passwords of EarthLink users to create as many as 1,000 accounts used to send unsolicited e-mail. The case was handled by EarthLink's outside counsel, Paul F. "Pete" Wellborn of Wellborn & Butler LLP.

	E-Commerce, Internet
	Sign up to receive free daily business updates by email every weekday afternoon.
	Use Search Watch to watch for related topics, companies.
	Receive free Industry News via email. Choose from 46 different industries.

The lawsuit alleged that a Johnson City, Tenn., man, Khan C. Smith, pocketed at least $3 million in profits from illegal Internet use. The suit names up to 50 additional "John Doe" defendants who have not yet been identified in court papers.

Smith used dummy Web sites and domain names to send spam promising free credit reports or free Internet service, but in order to get the free goods, users would be asked to submit a credit card number, password or other personal information to secure their new account.

Some of the sites touting free goods required the user to download some software that contained viruses or worms (called Trojan horses) that allowed Smith to remotely access private information on the user's computer.

Smith and others would then use that information to set up new spam accounts or resell those accounts to other spammers, according to the lawsuit. Two of the sites EarthLink traced directly to Smith were NationalISP.cc and ArchAngelMail.com.

Expensive spam

EarthLink estimates Smith's scheme accounted for as much as 12 percent of the company's total e-mail traffic between September 2000 and August 2001 and cost the company an estimated $4.1 million in bandwidth and delivery expenses, lost profits, administrative and attorney fees and other anti-spam measures, the lawsuit said.

Overall, spam represents 25 percent to 50 percent of all the e-mail traffic on EarthLink's system, with that figure climbing higher during the evening and weekends. EarthLink processes about 10 billion e-mails per year, at a cost of one-tenth of a cent each (or $1 per 1,000 e-mails).

The spam issue has become such a burden in recent years that EarthLink has built up a staff of 14 that works full time on fraud and abuse cases.

"We have a team of people watching for abuse on the network," said EarthLink spokesperson Carla Shaw. "They have certain measures and guidelines and things they are looking for, certain thresholds. And their job is to track it back [to the sender]."

Rival Internet providers AOL Time Warner Inc. and Microsoft Corp. each have full-time staff dedicated to stopping spammers and preventing abuse or fraud.

"AOL has won or settled over 40 spam cases worth tens of millions of dollars ... but the most important step in winning the war on spam is to get an injunction to stop the spam," said AOL spokesperson Nicholas Graham.

Is it spam?

Some companies are dedicated almost entirely to helping other businesses establish and adhere to marketing guidelines or privacy policies that are not bothersome to customers or business associates on their e-mail distribution lists.

Larry Ponemon is CEO of The Privacy Council Inc., a Texas-based firm that consults with larger corporations about responsible use of customer information. The Privacy Council has been tracking spam ever since the first wave of junk e-mail began appearing in in-boxes in the mid-1990s.

"There is a very fine line between what is spam and what is a promotional message, and non-spam can easily become spam if it's not relevant to you or if it's sent too frequently," Ponemon said. "Spammers are also becoming smarter and more savvy at getting past filters or firewalls."

Ponemon said spammers have also become more malicious in recent years, stealing credit card or Social Security numbers, whereas they used to stick primarily to sending e-mails to promote products and services.

"It used to be that you just had 1,000 e-mails to go through, but we are getting away from nuisance spam now and moving toward destructive spam," he said. "They're stealing Social Security numbers now, and that number is with you for life. It's not like a credit card where you can cancel the account and get a new one."

Spam evolved from e-mail used as a cost-efficient marketing tool, whereby businesses could communicate with hundreds or thousands of their customers for just pennies per message, far less than the 50 cents or more spent on traditional mailers.

As e-mail took off, spammers realized that it was a cheap way to hawk goods to mass audiences. The anonymity of the Internet and the access to Internet service made it easy to set up dummy accounts or domains.

Lists of e-mail addresses can be cheaply bought from marketing firms or randomly conjured with off-the-shelf software, and an investment of another couple of hundred dollars will buy more software that will generate and send hundreds of thousands of e-mails each day.

Even if thousands of the spam mails are rejected or filtered, the spammer makes money if just a few recipients purchase the goods being advertised or pass along personal information.

Often, spammers are merely after credit card numbers or passwords so they can set up new accounts and continue to spam, experts say. Multiple aliases and manipulated domain addresses make computer-savvy spammers hard to catch.

"They are wily," Shaw said. "A lot of them are associated and familiar with one another. There seems to be somewhat of a community out there."

It usually takes several days to track down a spammer, and by then he or she has moved on to new accounts. Most of Smith's accounts, for example, were discovered and shut down within two or three days.

Just about every legitimate company that handles e-mail marketing campaigns includes an opt-out tool for users who don't want to receive such pitches in the future, and most companies also limit the number of recipients who receive targeted or tailored pitches, said Bill Nussey, CEO of mass e-mail software-maker Silverpop Systems Inc.

"Some businesses think e-mail is so low-cost that they treat it like broadcast media such as TV or radio, and it doesn't work that way," Nussey said. "Can you imagine a message that would be equally interesting to 2 million people on your distribution list?"

Silverpop advises its customers to send smaller batches of more personalized e-mail that recipients would be more likely to be interested in. For example, an airline may promote special fares to certain cities that a customer has already purchased several tickets to.

"When a message comes from your company this way, it's going to be as well-received as a message from a friend or family member," Nussey said.

Ponemon cautions that even legitimate e-mail marketing campaigns can become spam if the recipient is overwhelmed by them or cannot remove himself from the distribution list.

One of the troubles of the opt-out is that the person making the request has no way of knowing whether the sender complied, Ponemon said.

"There is no consequence for companies if they don't remove you, so where's the incentive?" he said. "You have to call these people and complain and maybe even hire a lawyer to get them to stop. The process is so complicated and time-consuming that people just give up."

There has been speculation that Congress or a regulatory body like the Federal Trade Commission would take up the spam issue and create some sort of "do not contact" list for e-mail users, although previous attempts at generating such legislation never made it far.

Until there is some type of regulation of e-mail use, companies such as EarthLink are hoping lawsuits like the one against Smith will act as a deterrent to other would-be fraudulent spammers.

Reach Credeur at mjcredeur@bizjournals.com.

Copyright 2002 American City Business Journals Inc. Click for permission to reprint (PRC# 1.1670.627310)

Printable Version

Email Story