Spamhaus is a well-regarded registry of bad actors. The British nonprofit, along with partner organizations, tracks the IP addresses that spew most of the spam issued forth worldwide. They also use honeypots and other mechanisms to keep a dynamic list of infected computers and IP addresses that act as vectors for infection. And they owe a guy in Illinois nearly $12 million due to a default judgment issued by a U.S. District Court judge when Spamhaus failed to contest a lawsuit.
That judgment may dog Spamhaus for some time to come, regardless of their seemingly accurate assertion that, as a firm that does business in the United Kingdom, a court in Illinois lacks the jurisdiction to summon Spamhaus to court in the first place.
The suit was brought by David Linhardt, who operates e360 Insight, and who alleges that Spamhaus has misrepresented the nature of his business - opt-in mailings, he claims - and impaired his revenue. Linhardt maintains that Spamhaus does business in the jurisdiction of the Illinois court in which he filed the suit. Spamhaus has annotated a record in its Registry of Known Spam Operations (ROKSO) with details of what Spamhaus states are e360's associations with spammers and use of IP addresses controlled by spammers. They also include the colorful email received by Spamhaus from Linhardt.
Spamhaus initially responded to the lawsuit to prove that it had no business in Illinois and was not under the court's jurisdiction. Spamhaus then withdrew, because they thought responding might constitute de facto acceptance of jurisdiction on their part. Their failure to appear led to the default judgment of $11.7 million against the organization, along with Spamhaus being required to declare positively that e360 is not a spammer and stop blocking email from the organization. (Spamhaus has a variety of documents about the trial, but one Web page is rather clear and current.)
Following the judgment, e360 submitted a proposed order to the judge that would have ordered the global Internet domain authority ICANN (Internet Corporation for Assigned Names and Numbers) to suspend the registration of spamhaus.org, the UK group's domain name. ICANN quickly responded that if so ordered by such a court, it lacked the authority to order a registrar to suspend a registration.
The proposed order caused an eruption around the Internet, with the notion that a U.S. court could suspend a domain name outside of the internationally accepted dispute resolution process and the quasi-extraterritoriality that ICANN and domain names enjoy. While the naming and numbering authority is federally chartered by the United States, many countries have also tacitly or explicitly ceded that authority to ICANN; others dispute its authority or accept it only grudgingly at the moment. (If you want to start a fight in a hypothetical Internet geek bar, start praising or condemning ICANN.)
The judge ultimately declined last week to issue the order, noting that it was overly broad, thus avoiding what was characterized as an Internet constitutional crisis. (Further, the registrar in question, Tucows, is based in Canada!)
Spamhaus is now appealing the judgment with the aid of pro bono services provided by the Chicago law firm Jenner and Block, which volunteered itself after being urged by clients who support Spamhaus's efforts, and who the law firm declined to identify. Statements by Spamhaus chief Steve Linford indicate that the appeal will focus on the issue of jurisdiction.
Linford has said that stronger laws in the UK that actively prohibit spam - as opposed to U.S. laws which provide civil penalties if spammers are prosecuted - coupled with a loser-pays court system have led spammers to choose lawsuit venues merely to gain an advantage in the proceeding, a practice known informally as "forum shopping."
Spamhaus provides a way for anyone with a mail server to use the service's collected information to calculate the probability that an incoming message is unsolicited commercial email (UCE, or spam's nicest euphemism) - or simply to block messages. For instance, SpamAssassin has a simple method for incorporating Spamhaus and similar monitoring databases and blacklists into its scoring system.
On its own, Spamhaus doesn't block any email, in contrast to a service like Postini - used by TidBITS thanks to digital.forest - which operates spam and virus filters for its subscribers' mailboxes; or, for that matter, like any ISP, including America Online, which filters out supposed UCE.
If you're unclear about how Spamhaus operates, think of it this way: Suppose I have the Caller ID service on my phone line, and I have a large printed directory that I ordered from a firm in England of phone numbers that might be used by disreputable parties. When my phone rings, I grab the book and quickly look up the number. I may choose to answer the phone or not, but if the number is in that directory, I'm inclined not to, out of hand. Some telemarketers might maintain that they only place calls to people who asked to receive them. One of them might even want to sue the publisher who sold me the directory. But as the receiver of calls, I'm well positioned to know whether I told someone they could call me or not.
The outcome of the appeal of this case could have a fairly wide bearing, no matter what decision is rendered. An appeals court could side with Spamhaus, agreeing on the question of jurisdiction and requiring the lower court to vacate the judgment. It would be quite awkward if anyone providing information via the Internet could be sued in any jurisdiction in the world, not just those in which they happen to have locations of business or other bases on which jurisdiction is typically established. (In a contract between two parties, the contract typically states under what law and in what jurisdiction actions must take place.)
Alternatively, an appeals court might disagree with Spamhaus's attorneys and dismiss the appeal, leaving the judgment to stand. Were that to happen, it might still prove difficult for e360 to collect on the judgment, and the judge has already proven uninterested in attempting to create worldwide disharmony by ordering a domain suspended. That could change, too. Such a judgment might prevent Steve Linford from visiting the United States again, however, as e360 could potentially have him arrested were he to arrive.
Finally, an appeals court could remand the case back down to the lower court on some basis, and Spamhaus might, at that point, choose to defend itself on the facts, rather than on the meta-facts of the case.
As long-time spam fighters, we're rooting for a successful appeal on jurisdiction. Alleged spammers shouldn't be denied their day in court, but they should have to sue in the appropriate court.