When a lawyer gets hit by spammers, expect a lawsuit

In one of the few instances of an individual taking a spam fight to the courts, a New York lawyer has filed a lawsuit alleging that his e-mail address was hijacked and used to send messages promoting a company's stock.

The lawsuit, filed Thursday in U.S. District Court for the Southern District of New York, charges that China Digital Media, a Nevada corporation with operations in China, and its unknown promoters, named in the suit as "John Does 1-10," used lawyer Scott Ziegler's e-mail address as part of a spam campaign. The suit seeks millions of dollars in combined damages.

Filed on behalf of Ziegler and his Manhattan firm Ziegler, Ziegler & Associates, the suit claims that between about April 29 and May 3, Ziegler received thousands of bounced promotional e-mails bearing his business address in the "from" field.

"It was a severe disruption to my workdays," Ziegler said in an interview. "At some point it overloaded my mailbox, so I could not receive any other messages that I needed to get."

According to the suit, Ziegler was "surprised and dismayed" to receive the e-mail rejections because he did not send or authorize the e-mails. He became concerned that people who received the promotional message, including clients or potential clients, would assume he had sent or approved the mailing, the suit said. His firm's client list includes banks and securities companies, according to the lawsuit.

As unsolicited e-mail has proliferated, law enforcement agencies and Internet service providers have stepped up their pursuit of spammers, but the effort has done little to curb the problem. Now some smaller organizations and e-mail users, such as Ziegler, are taking action themselves.

According to the lawsuit, Ziegler contacted China Digital Media prior to filing the action and received an e-mail from Chief Executive Officer Daniel Ng. In the e-mail, Ng confirmed that his company hired a stock promoter but denied having anything to do with sending spam with Ziegler as the return address. He did not name the promoter and apologized for any embarrassment.

A copy of the e-mail from Ng as well as examples of the bounced spam messages were filed with the lawsuit.

An apology was not enough for Ziegler. "I was amazed that somebody spammed with an e-mail address that was a real e-mail address, thinking that there would be no ramifications," he said. "We decided to take matters into our own hands."

China Digital Media's Ng did not respond to an e-mail and phone call seeking comment.

Ziegler is one of the few individuals to sue an alleged spammer, said Ray Everett-Church, co-founder of the Coalition Against Unsolicited Commercial E-mail and co-author of the book Fighting Spam for Dummies. Usually, Everett-Church said, large organizations or prosecutors bring cases to court.

"For an individual to bring a case is fairly rare, because most individuals don't want to go through the time and expense to track down who was responsible," he said.

Still, Everett-Church and Ziegler both said they would like to see changes in the law to make it easier to fight spammers. "The legal remedies available to folks are not equal to the volume of the problem," Everett-Church said. "You cannot sue spammers fast enough to make a real dent in the problem overall."

Ziegler is relying on current law to enforce his suit, he said in the interview, "but more can always be done on the legislative side."

Gr8 going

I hope all spammers get into jail and that they get a cellmate called Bob who likes to "drop the soap".

Actually the only thing that's annoying to me is spam since I have no viruses/adware (on Linux) but even the best of spamfilters cannot stop everything.

[George Cole]

best of spamfilters

http://www.analogstereo.com/jaguar_xjs_owners_manual.htm

[hadaso]

One more reason not to "unsubscribe" from spam

This is one additional reason not to "unsubscribe" from spam! When the spam says to "unsubscribe" by replying, you might just be sending spam to one additional spam victim (the one whose email address was used in the "From" or "Reply-to" fields.

I usually try to unsubscribe from cerain spam messages (NOTE: only from an address I use for receiving and reporting spam though spamcop.net and never from an email address I use to get real email). I do it so I can record the unsubscribe requests and include details about not honouring them in subsequent complaints about the same spammer). But just a few minutes before reading this story, I followed the "unsubscribe" instructions on a spam message that said to just "hit reply" to unsubscribe, but it seems now that the reply was sent to an innocent third party. My experience is that usually these kinds of "unsubscribe" instructions either send to a non-existent address, or to a real address of the spammer that usually is "over quota". Most spammers that want a fake "unsubscribe" option just use a fake URL.

So in fact' if you want to make sure you don't send spam yourselg, you should never "unsubscribe" by replying to an email.

This is one issue in which CAN-SPAM completely fails, by giving spammers a tool for making recipients participate in a denial of service attack: the only way for a recipient to comply with the act is to follow the "unsubscribe" instructions, even when following them just sends more spam, and there's no easy way for the recipient to tell working instructions from non-working or malicious instructions. If "opt-out" is to work, it must be done through a "trusted party", i.e., only by a link to a recognized agency that handles these requests and that the recipient trusts.

Right now it is dangerous to reply to spam, or just follow unsubscribe instructions, not just because your own address is revealed, but also because by doing this you might be participating in an online attack on a third party!