Yet after Hoffmann was added to Rokso, and Shiksaa confronted her about using the alias Natasha, Hoffmann at first denied it. That proved to be a mistake on many levels. As proof that Hoffmann had been hiding behind the pseudonym, Shiksaa produced a snippet of an AIM conversation between Hoffmann and another Internet user, whose screen name Shiksaa had redacted. In the brief exchange, "Karen Hughes" jokingly told the unidentified person that she was "Natasha."
When she saw the evidence Shiksaa posted on Nanae, Hoffmann was mortified, and not just because she realized it was incontrovertible. Hoffman recognized the conversation; she had been chatting with Dustin Parker at the time. Clearly, Parker had betrayed Hoffmann and had given Shiksaa a copy of the log file of their chat. Hoffmann wondered what else Parker had shared with Shiksaa.
By December 2003, Hoffmann had her own entry on the Spews blacklist. Spews listing S2938 stated that she was "an anti-spammer gone bad" and called her "spammer Scott Richter's list-washer." Besides ListSupport.net, Spews listing S2938 also included the address of her personal site, ToledoCyberCafe.com. Hoffman's Spews entry even contained the IP address of her cable modem service from Buckeye Express.
Hoffmann thought it petty of Spews to black-hole ToledoCyberCafe.com. But what bothered her most was the mystery of how Spews had gotten the cable modem's IP address. She had been very careful not to disclose it in the headers of her newsgroup and email postings and always used her AOL account to post messages. And, as far as she knew, AOL Instant Messenger wouldn't reveal her cable modem's IP address to others.
Hoffmann ran a search for the IP address in all of the text files on her computer. The only place it showed up was in an AIM chat with Parker, in which she had intentionally sent him the IP number. Obviously, that chat log file was among those Parker had given to Shiksaa. But that still left the question of how Spews had gotten her IP address. Somehow it had gone from Shiksaa's hands to the blacklist operators.
As Hoffmann saw it, there were only two possibilities: either Shiksaa had given it to someone connected to Spews, or Shiksaa herself was directly involved with the blacklist.[17]
* * *
[15] From a memorandum recorded June 6, 2003, by the New York State Board of Law Examiners.
[16] Ironically, Middlebrooks was also the judge who sentenced Eddy Marin in June 2000 to twelve months in jail for money laundering.
[17] While others have also speculated about Shiksaa's connection to Spews, I have been unable to confirm any of these rumors. Shiksaa adamantly insists she is not involved with the mysterious block list.
Richter Unravels
When Scott Richter tried to reach Dustin Parker on his company cell phone one Saturday in early November 2003, the sultry voice of a sex-chat-service operator answered instead. Assuming he had misdialed the number, Richter hung up and again tried phoning Parker, the head of information technology at OptInRealBig. But the call went through to the sex line the second time as well.[18]
This was not a good thing. Richter and other company personnel routinely gave out Parker's number to major customers who needed after-hours technical support or other customer service. Richter's first impulse was to blame anti-spammers. The previous spring, someone had apparently hacked into OptinRealBig's telephone network switch. The hackers enabled a feature that caused the twenty-four phones in the building to begin ringing all at once. Employees had to unplug their telephones for several hours while the company tried to solve the problem.
But anti-spammers weren't responsible for the latest telephone prank. When Richter finally reached Parker on his private line, the 18-year-old admitted he had set up his company cell phone to forward to the sex line. Parker said he did it as a joke. But Richter soon realized that Parker had a different goal in mind. He wanted customers to think OptInRealBig was going out of business.
After picking up his last paycheck on November 7, Parker had joined a mutiny by six key OptInRealBig employees. Parker, the kid who had been Richter's right hand from the start, and into whose PayPal account the two had dumped their first Internet sales, had walked off the job and apparently taken confidential company information with him. Parker, whose name was listed on many of OptInRealBig's domains and who had even lived in Richter's house at one point, was sabotaging the company he helped build. Parker, the mini-Richter—just five-eight, but checking in at around 200 pounds—had double-crossed his mentor in order to work for a new boss, OptInRealBig's former sales manager, Jeff Perreault.
Perreault, 30, had been with Richter a long time too. Richter had listed him as the company's manager when they incorporated OptInRealBig.com LLC shortly after the 9/11 American flag spams. He even made Perreault a 10-percent owner of the firm. But after several months of missing sales targets, Perreault was fired by Richter in October 2003. Richter offered to keep him on as an independent contractor and gave him $10,000 in severance pay when Perreault accepted the deal in writing a week later.
Richter had no idea Perreault would so blatantly breach the contract. The former sales manager, along with Parker and the four other OptInRealBig employees, had quietly set up Avalanche Denver Internet Marketing, their own spamming operation, soon after leaving Richter's firm. Perreault promised that, unlike OptInRealBig, the new company would distribute its winnings more equitably. But first, they'd need some customers. Working from an office Perreault had set up in Denver, the crew was on the phones to prospects, most of them gleaned from stolen copies of OptInRealBig's customer list. They told prospects that Richter's firm couldn't function without Parker and was likely going under. Some OptInRealBig customers decided to make the switch.[19]
On their way out the door of OptInRealBig, Parker and his colleagues had grabbed several goodies besides the customer list, including a couple of computer hard drives, the company's financial records, and some proprietary software, including OptInRealBig's program for automatically removing spam recipients from mailing lists, as well as the complete database of email addresses generated by the program.
Richter also had reason to believe that before Parker left the company, he had set up OptInRealBig's mail server to intercept email addressed to Richter or his father, the corporate counsel. Records showed that Parker had also tapped into other email accounts to access confidential information. Then there was the report from Hoffmann that Parker had sent copies of his IM logs to Shiksaa, in a clear breach of his nondisclosure agreement. Richter knew there was no telling what kind of information Parker was feeding the anti-spammers. (In fact, Parker had also revealed to Shiksaa he was the one who had "photoshopped" the images of her condo after Richter had given him the photos.)[20]
Richter contacted his attorney in Denver and began working up a lawsuit against Parker, Perreault, and the others. The plan was to hit them with breach of contract, business interference, trespass to chattels, and a slew of other charges. Richter wanted a court to issue a preliminary injunction that would stop the ex-employees from further sabotaging OptInRealBig's business.
But at the beginning of December, Richter suddenly found himself on the receiving end of a lawsuit. Officials from the New York Attorney General's office wanted to talk with him about several batches of spam that had been sent out from May through July of 2003 using proxies and fake headers. New York State prosecutors said they had traced the sites advertised in the spams to a New York company called Synergy6, which said it had subcontracted the emailing to Richter.
Richter knew New York's Attorney General Eliot Spitzer was on the warpath against spammers. In February of that year, Spitzer had pulled off a successful lawsuit against another self-proclaimed "opt-in" email-marketing company. A federal court judge ruled that Monsterhut, a Niagara Falls, New York—based firm, was deceptively representing its service as "permission based" or "opt-in," when in fact Monsterhut's mailing lists contained millions of email addresses of consumers who had never asked to receive ads. The court permanently banned Monsterhut from engaging in such acts in the future.
In a conference ca
ll with Spitzer's office, with Richter's dad on the line in San Diego, Richter explained that OptInRealBig had never directly sent any messages for Synergy6 during the period in question. All the email was the work of one of his affiliates, a Texas company named Delta Seven. Richter explained that OptInRealBig had forwarded to Delta Seven the few complaints his company had received about the messages. He provided investigators with contact information for Delta Seven's owners, Paul Boes and Denny Cole, and hoped that would be the end of his involvement in the matter.
But a week later, a certified letter arrived from New York. It announced that state regulators had commenced litigation against Richter, "among others." The letter accused him of a variety of deceptive business practices, including email header forgery, as well as false advertising. A few days later, Richter got word that Microsoft was teaming up with New York on a parallel lawsuit, on the grounds that its Hotmail service had received potentially millions of the illegal spams.
The whole matter apparently grew out of a complaint filed by a Hotmail user in June 2003. After receiving several unsolicited emails for "free" offers from Synergy6, the Washington resident had reported the spam to Microsoft, with carbon copies to numerous agencies, including the Federal Bureau of Investigation, the Federal Trade Commission, and even the International Criminal Police Organization, or Interpol.
Upon investigating the complaint, officials at Hotmail discovered that spam traps they had set up received over 8,000 copies of the messages advertising Synergy6 web sites between May and June of 2003. (The ads had been sent to unpublished addresses created by the service to track spammers, especially those who claimed recipients had opted to receive the messages.) The Synergy6 spams touted a variety of "free" gifts ranging from donuts and sunglasses to electric toothbrushes and a pornographic video entitled Girls Gone Wild.
In order to take advantage of the offers, consumers had to provide personal information at the coregistration sites, including demographic data, and consent to receive future mailings from Synergy6 or its partners. In most cases, consumers also had to make a purchase at one of Synergy6's sites in order to qualify for the "free" gift. (The terms and conditions of Synergy6's offer didn't sugarcoat the fact that consumers who registered would have their information sold to "marketing partners." Yet Synergy6 said it was not responsible for helping consumers get off the mailing lists of those third parties.)
After analyzing hundreds of spam samples, prosecutors determined that Delta Seven had routed the messages through proxy computers all over the world in an effort to protect the company's identity and avoid spam blacklists. Out of the hundreds of proxies used by Delta Seven, scores were hacked or virus-infected computers operated by customers of Comcast and other cable companies.
As Richter awaited the details of the New York and Microsoft lawsuits, he decided to drop the hammer on Parker, Perreault, and the other defectors. On December 11, his attorney filed a sweeping lawsuit in Denver district court, requesting not only injunctive relief against the former employees but also punitive and compensatory damages.
Parker was badly shaken by the news. That day, he was pulled over by police a couple of blocks from Denver's Pepsi Center sports arena and was charged with driving while his ability was impaired.[21] Later, Parker contacted Shiksaa and pleaded with her to sign an affidavit saying he had never given her any AIM logs.
After Shiksaa refused to lie for Parker, the two didn't chat again. But she was surprised to get an instant message from Richter around noon on December 17. He matter-of-factly informed her that the New York Attorney General and Microsoft were going to announce a lawsuit against him the next day.
"Should be good news for you guys to cover, since you all love me so much," he said.
When Shiksaa asked for details, Richter told her Paul Boes of Delta Seven was really the target of the lawsuits. According to Richter, Boes was in trouble primarily for sending mail through proxies. Richter's only involvement, as he explained it, was introducing Synergy6 to Delta Seven.
"No idea why I'm part of it," said Richter, who claimed the lawsuit would actually end up helping him. "More press to show I did nothing wrong and don't use proxies," he said.
Shiksaa told Richter to keep her apprised of the details and then said goodbye. But as she thought over the matter later that afternoon, Shiksaa began to wonder whether Richter's indifference to the lawsuit was justified. She knew that Boes and Richter had been business associates for years. Boes had sold his company, Wholesalebandwidth (WSB), to Richter that fall but had stayed on as a WSB customer. Shiksaa did a quick Usenet search and found a handful of reports from Internet users who had received spam from WSB throughout the summer. All of the reported spams contained bogus headers meant to look as if the messages originated from Hotmail or AOL. Such header forgery was obviously Boes's modus operandi.
Shiksaa confronted Richter over AIM. "Scott, you knew Boes forges headers," she said.[22]
Richter replied that he never really looked closely at Boes's messages. In any case, the spammer hadn't been using Richter's network since May, Richter claimed.
"Your abuse desk has nothing on him?" asked Shiksaa.
Richter said he hadn't received any complaints about Boes. "I do not allow anyone doing illegal things," he added.
Shiksaa cut and pasted some of the WSB spams she had located.
"You said he never forged while he was with you," she told Richter. "I say you either are lying, or you haven't bothered to read your abuse mailbox."
"The last thing in the world I need to do is have someone doing something wrong on net space I'm on, as I know I'll get the blame for it," he said.
Shiksaa pasted a few more examples of WSB spam with forged headers. "Why do you continue to deny it?" she asked.
"I do not run the abuse department," he replied.
"Then they knew it, and it went on for months."
Richter paused a moment. "Susan, let me ask you this, and answer honestly..."
"I'm always honest."
"What incentive do I have to throw anyone off? Spamhaus and Spews would never de-list me, right? As long as someone is not breaking a law, what is the point to get rid of business?" he asked.
Shiksaa couldn't believe Richter's swift about-face. "You are responsible to know what goes on in your company," she said.
"I know how to promote and run a business, not a tech department."
"And what's Karen's excuse?" asked Shiksaa, referring to WSB's abuse department head, Karen Hoffmann. "She can read a header can she not? She was your employee. You are responsible."
Before Richter could reply, Shiksaa came right back at him. "You know what? Just to repay you for publishing my father's information out of spite, I'm going to make sure the attorney general's office knows where to find proof of forgeries," she said.
"Susan, I never forged, and I had nothing to do with your dad."
"You published my father's personal information out of malice. Now I'm going to repay that favor, Scott. Don't contact me again. And I hope you get sued into oblivion."
"Whatever," was Richter's only response.
As Richter predicted, New York Attorney General Eliot Spitzer and Microsoft General Counsel Brad Smith held a joint press conference the next day in New York to announce their lawsuits. Spitzer began by describing the three respondents, referring to Richter as the third-largest spammer in the world. Then Spitzer zeroed in on the subject of header forgery. He noted that Microsoft's spam traps had attracted over 8,000 spams from Scott Richter in a one-month period. All of the messages, according to Spitzer, contained bogus headers designed to evade the spam filters used by ISPs and computer end users.
All told, there were 40,000 "fraudulent statements" in the messages, said Spitzer. Then he announced his office's intent to sue the spammers $500 for each fraudulent statement, or a total of twenty million dollars. The goal, he said, was to make other spammers realize their business was unviable.
"We will drive them into bankruptcy, an
d therefore others will not come into the marketplace to take their place," he promised.
When Microsoft's top lawyer Brad Smith took his turn at the podium, he announced the company's intent to separately seek damages of eighteen million dollars from the spammers.
"If these people have any money left after the New York Attorney General's lawsuit in New York comes to a close, we will be happy to pursue the remainder," said Smith to laughter from the press corps.
During the question-and-answer period that followed, Spitzer was asked whether investigators had determined the profitability of the spammers' businesses. He responded that Richter was "clearing several million dollars a month in profit," and that the damages sought by Microsoft and New York would be "sufficient to wipe out whatever profit he has made."
But one reporter wanted to know how a strong case could be built against Richter, since OptInRealBig apparently had farmed out the spamming to Delta Seven. Spitzer assured the media that prosecutors would be able to establish liability "up the chain of command...and prove without a doubt that those, including Richter...are liable for the misbehavior of those that actually stand there and push the buttons."
New York prosecutors also released 619 pages of exhibits gathered in support of the complaint filed in New York Supreme Court. The evidence included dozens of email messages between employees of Synergy6 and OptInRealBig. The emails showed Richter deeply involved in the day-to-day operations of the Synergy6 spam campaign. In one exchange, Richter shrugged off Synergy6's chief operating officer's concerns that Delta Seven's messages contained forged header information.
Spam Kings Page 28