Home / Blogs

Spam Fighting: Lessons from Jack Bauer?

As I blogged about several months ago, as did numerous other anti-spam bloggers, David Ritz was sued by Jeffrey Reynolds and a judge in North Dakota agreed with Reynolds. At the heart of the case was that Ritz engaged in anti-spam activities using techniques known only to a small subset of advanced computer users, and used these techniques maliciously against Reynolds.

A couple of years ago, I reviewed the book Spam Kings. Back in the olden days of spam fighting, some anti-spammers used to use malicious techniques against spammers in order to shut them down. Maybe they’d break into their web servers and disable them, maybe they’d flood the spammers’ email addresses with unsolicited mail or cripple their operations with DOS attacks. Regardless, the point is that they would use illegal techniques to shut down spammers. The idea was to fight fire with fire. Spammers are annoying? Then you have to get your hands dirty to shut them down. Some people on anti-spam discussion forums cheered the moves; others said that spam fighters could not resort to the level of the spammers themselves.

Last night (Jan 11, 2009), I was watching the premiere of 24, Season 7. In the opening scenes, Jack Bauer is brought to Washington and is being interrogated by a Senate subcommittee on charges that he tortured various terror suspects and therefore broke United States law banning torture. Bauer even admits that he broke the Geneva Conventions. To escalate the tension, the Senator asks Bauer if he thinks he is above the law.

24 is all about drama. Bauer looks at the Senator, and says (and I paraphrase) “Don’t give me that smug look. These people who try to attack us don’t play by your rules. I did what I had to do in order to protect the people of this nation and I will answer to them.” Bauer is quite unrepentant in his beliefs that while he did break the law, he did it to protect the citizens of the country and he does not apologize for it. Bauer gets results (the Senator did not watch the previous six seasons of the show).

Spam fighting would never be the focus of an episode of 24. It’s not quite that glamorous. But the philosophical issues Bauer brings up are valid—if anti-spam fighters start engaging in dubious tactics to shut down nefarious spam operations, how apologetic should they be? Should they (we) even sink to a level of questionable ethics?

Let’s say that a web site is discovered that is selling counterfeit pharmaceutical products, an activity that is quite illegal. Some hackers can take down the site in a matter of minutes using a DOS attack. Should we do it?

A spam operation is sending out stock spam, illegally pumping and dumping a penny stock traded on the pink sheets. An anti-spam operation can break into their servers used to send email and shut it down. Should we do it?

There are plenty of examples of spam, botnets and viruses used for illegal activity, from fake university degrees (fraud) to porn operations (exploiting underage children). In some of these cases, these types of activities can be reverse engineered and shut down. Obviously, by approaching the proper authorities, many of them can be deactivated. However, sometimes the proper authorities lack the knowledge or the willpower to stop supporting all of this stuff. The McColo incident is a prime example; if we knew for so long that McColo could have taken have the spam world off-line, why did it take so long? Could somebody just have gone and cut off the power to the building? Would that have been right or wrong?

It’s a philosophical problem—how much are we willing to put up with when it comes to spam, and what levels should we sink to? And who should we answer to? The security industry? Or the end users we are acting in the name of to protect?

By Terry Zink, Program Manager

Filed Under


Please! Take it easy on shutting power Michael Roberts  –  Jan 13, 2009 4:11 AM

Please! Take it easy on shutting power to that data center, my server is in the building.

Please leave Ritz out of this John Levine  –  Jan 13, 2009 8:22 PM

Regardless of what you might think about vigilante anti-spam techniques, the Ritz case was a travesty of justice.  The “advanced” technique that the judge was bamboozled into interpreting as a malicious attack was an ordinary DNS zone transfer request, something that sys admins have routinely done for decades.

More on Ritz John Levine  –  Jan 13, 2009 11:15 PM

See this CircleID post from a year ago:


Really, leave Ritz out of it John Levine  –  Jan 14, 2009 3:04 PM

This is not “anti-spam activities,” this is hacking into a private network and committing computer crimes.

Yes, that’s the ridiculous misinterpretation of Ritz’ perfectly normal actions that the court was bamboozled into accepting. The parties in this case both have long histories online, and if you look at the background of the case, it’s crystal clear who is the good guy and who is the bad guy.  It is rare for a state court to get a case as wrong as this one did, but the actual facts speak for themselves.

More lies about the Ritz case John Levine  –  Jan 14, 2009 5:43 PM

This guy made zone transfers in order to map the internal network and then he went and attacked the network using this information.  He used proxies to try to hide his identity and defied a court order.

David did do a routine zone transfer to try and identify the hosts that Reynolds was using to spew usenet spam, but he did none of the other things you accuse him of.  If he had not been near death in a coma in the hospital when Reynolds sued him, he’d have been able to respond more successfully.  Incidentally, Reynolds was the provider; his goal in his SLAPP suits has been to hide that fact.

I really wish you would inform yourself better rather than just parrot the false accusations in this case.  Also see

Not like you to reply to random anonymous trolls, John .. Suresh Ramasubramanian  –  Jan 17, 2009 3:24 PM

Wish circleid had a killfile.

Some notes Terry Zink  –  Jan 18, 2009 8:23 AM

When I alluded to the Ritz case, I was not implying I agreed with the ruling against him.  Rather, I was framing my post by loosely painting it against a backdrop of a real life situation.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet



Domain Names

Sponsored byVerisign


Sponsored byDNIB.com

New TLDs

Sponsored byRadix


Sponsored byVerisign

IPv4 Markets

Sponsored byIPv4.Global

Brand Protection

Sponsored byCSC

Threat Intelligence

Sponsored byWhoisXML API