Home / Blogs

ICANN Ordered by Illinois Court to Suspend Spamhaus.org

Information about this court ruling can be found on Spamhaus’s website [PDF]. Apparently, at this stage, it is only a proposed ruling. But I am no lawyer.

This story has been discussed before, when Spamhaus, which is located in the UK, was sued in the US by a spammer.

They refused to come before the court as “they do no business in Illinois, and are located in the UK.

Legal issues aside, imagine what would happen if Spamhaus was forced to present itself before courts all over the world, where they don’t even do business. They are a volunteer organization and spammers will stop at nothing to get at them.

After this court ruling, Spamhaus.org was under a DDoS attack, in my opinion for the purpose of preventing users from reaching the information it provided about the court ruling. This was done along-side a Joe Job, sending fake email appearing to come from Spamhaus’s CEO, Steve Linford. This email provided disinformation about the court ruling, claiming that anyone who uses the Spamhaus service can be facing legal action. This was false.

This court order (potential court order) to ICANN is the one of the most dangerous things that could potentially happen to the Internet, and it needs to be squashed. Next, we would see the court going after Spamhaus mirrors, Registrars or RIRs.

ICANN, while being composed of good people who do try and do good, does very little as an organization where it comes to stopping abuse. A lot of this abuse involves millions on millions of domain names. These are used for spam, phishing, CP, botnets and a lot of other such activities.

IF ICANN can now potentially be used to:

1. Attack an organization that keeps a lot of the Internet sane. Not just spam-free, but rather actively helps the fight against CP, phishing, etc.

2. Circumvent International law, forcing a foreign entity to answer the call of a court around the world, which ruled wrongly on business they don’t actually do.

3. Shoot itself in the foot, forcing the formation of a sort of alternate root (we will keep using Spamhaus, folks, no matter what) or a move to a different TLD or a ccTLD. It will no longer be a relevant body. Hey, everybody is talking about how to keep Spamhaus alive. That’s an idea that floats around a lot.

It will be a precedent which will open a can of worms, and there will be no end to it. This court ruling needs to be attacked with all possible force, by ICANN, the community, the news and everyone else who cares.

I still have faith in ICANN’s good people, and I still have faith in the law enforcement officers who use what Spamhaus freely gives to the world. I also have faith in the judges of the Illinois court, and believe they will make the right call.

This Illinois court will meet with a clue stick and clue up, they don’t currently seem to be very tech-savvy to me.

I am not sure at all ICANN can ignore such an order when it comes. ICANN will prevent this legal action, or something else will be done. Otherwise, maybe it IS time for an alternate root, as the alternate evil seems very shiny right now.

This is all yet to be determined, and mostly my opinion beyond the URLs provided. This, however, needs to be addressed. It is serious.

For now, what would be very nice is to see every ccTLD that “cares” provide with a free, courtesy domain name, and point to Spamhaus’s IP addresses. Spamhaus.co.il, Spamhaus.jp, etc.

I am rather inflamatory in this post, but to be honest, the world isn’t going to end, I will still go to Spmahaus’s website even if I have to go to .co.uk instead of .org.

By Gadi Evron, Security Strategist

Filed Under


John Berryhill  –  Oct 7, 2006 9:01 PM

For accuracy, Gadi, what you are looking at is not a court order binding on ICANN, and in fact is not a court order at all.

The document you are looking at is a proposed order that has been submitted to the court by the plaintiff.  The proposed order is to require the registrar to suspend the domain name because of an alleged violation of an injunction entered earlier in the case.

The proposed order is defective for several reasons, not the least of which is that it is directed at an entity which has not been a party to the litigation.

Gadi Evron  –  Oct 7, 2006 11:59 PM

Thanks for that clarification, John.
Further, Matthew Prince who is a lawyer in Illinois and quite spam savvy wrote a blog post on this subject, covering it from head to toe. Very interesting.

Simon Waters  –  Oct 8, 2006 6:10 PM

I’m curious - why ICANN?

Surely the response from ICANN’s lawyers will be if this is a matter pertaining to the operation of the “.ORG” domain, please demonstrate you have exhausted avenues via the “.org” registry.

Which would throw the matter to the PIR.

More basic still I don’t see how the domain is relevant here, he might as well sue the ISPs who route data to Spamhaus DNS servers.

If a credit rating agency gives you a bad rating, you don’t sue their telephone company to complain that they give them service.

I assume US law has some discretion for judges to say “this is the wrong person”.

John Berryhill  –  Oct 10, 2006 12:10 PM

I assume US law has some discretion for judges to say “this is the wrong person”.

The court has discretion to do whatever it pleases.  Here, the court is being asked to issue an order upon Tucows, which was never before this court.  The answer to any question premised upon “Can a judge…?” is yes.

Looking at the electronic docket of the case, it seems that Spamhaus was represented initially by CircleID member Evan Brown, who withdrew from the case and there was no subsequent participation in the proceeding by Spamhaus.  Odd that Spamhaus would seek removal from state court to federal court and subsequently claim lack of personal jurisdiction.

Suresh Ramasubramanian  –  Oct 11, 2006 11:41 AM

ICANN’s response - as expected


Please note that ICANN is not a party to this action and no order has been issued in this matter requiring any action by ICANN. Additionally, ICANN cannot comply with any order requiring it to suspend Spamhaus.org or any specific domain name because ICANN does not have either the ability or the authority to do so.


Jane Clinton  –  Oct 11, 2006 5:41 PM

It looks to me from what I see here and what I know about how ICANN and the law in general work that the headline this story is being sent around with is false. For example in your weekly email wrap.

I’m pretty sure it is simply not the case that:

ICANN has been Ordered by Illinois Court to Suspend Spamhaus.org

This error was first pointed out on 7 October, the very day the piece was posted.

Daniel R. Tobias  –  Oct 11, 2006 11:28 PM

If they switch to a .uk domain, it should more sensibly be under .org.uk rather than .co.uk.

Rod  –  Oct 12, 2006 3:20 AM

technically they are taking http://www.spamhaus.org to court when the effective domain name is spamhaus.org so they are not quite right.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet



New TLDs

Sponsored byRadix

Domain Names

Sponsored byVerisign


Sponsored byDNIB.com

Threat Intelligence

Sponsored byWhoisXML API


Sponsored byVerisign

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global