Twitter's Lawsuits Against Spam Tool Providers Could Easily Backfire

from the risky dept

It's no secret that there's a fair bit of spam on Twitter -- which is annoying -- and it's nice to know that Twitter knows this is an issue that it needs to fight. But I'm a bit concerned by the news that it's now suing spamming tool providers as well as some spammers. Going after the spammers directly for terms of service violations makes sense and they're fair game. But going after tools providers? That seems risky. I'm reminded of a very similar situation from a few years ago, in which Craigslist went after spam tool providers as well. Some of the details there raised significant questions -- most specifically in Craigslist arguing that service providers could and should be liable for actions of their users. That approach rejects the core concept behind protection from secondary liability -- something that's been quite important to tons of internet sites over the years, including Craigslist and Twitter.

I recognize how tempting it is to go after the tools providers over spam. But just as we don't blame Twitter or Craigslist for how users use (or abuse) their system, those companies shouldn't blame tools providers for the actions of their users either. At the very least, I could see it coming back (in a big, bad way) to haunt Twitter, by giving opponents in lawsuits the ability to point to Twitter's own claims against these tool providers to suggest that it, too, should be liable for the actions of its users. From the details (embedded below), it appears that Twitter is arguing that all users breached the terms of service -- and it carefully notes that each of the software providers have registered accounts -- meaning they agreed to the terms at some point. I understand why it's being argued this way, but I'm not sure it makes sense. The terms apply to that account, not everything that someone with an account does outside of the account. Twitter also claims that the spamware providers are involved in tortious interference with a contract as well as fraud and "unlaweful, unfair and fraudulent business practices" under California law.

To its credit, Twitter does not go as far as Craigslist did in its anti-spam lawsuits -- which actually tried to use copyright and trademark law, as well as claiming that violations of terms of service are a violation of the Computer Fraud and Abuse Act. Thankfully, Twitter avoids going down those paths where those very specific laws might come back to haunt it -- and sticking with slightly more defensible claims.

While I'm incredibly sympathetic towards Twitter's position here, and the goal of stomping out spammers, I still find it troubling in a few ways. Twitter can and should (absolutely) look at ways to kill spammer accounts and to block spamming tools through technological means. It's when things go legal that it could get tricky. While my heart wants them to win -- I still fear that the arguments that the service provider itself is guilty because their tools are used for spamming floats a little too close to arguments about whether or not Twitter is responsible for how its users use Twitter.

Filed Under: liability, spam, tools
Companies: craigslist, twitter

A Cracked Look At The Impact Of Spam

from the you've-got-some-insight-on-your-comedy dept

As you may know, I'm a pretty big fan of Cracked.com. They also share a lot of values with Techdirt. Recently, they published an angry tirade against spammers that's also an interesting look at how years of steadily-increasing crap have shaped user habits and expectations online. Examples include things like browser toolbars, which are almost universally hated and yet still bundled with lots of software and foisted upon users during the install process, often through a confusing combination of checkboxes and accept/decline buttons:

Can you imagine how we would jump down the throat of any real-world business that tried that shit? Imagine ordering your lunch at McDonald's, but when they got to the "fries" question, they phrased it as, "Don't you not want to not have fries with that?" Then, no matter how you answered that ridiculous triple negative, they told you, "By pulling forward to the next window, you are agreeing to buy fries" and shoved them into your car anyway, claiming, "No, you said you wanted them, so now you have to pay for them. No take-backs!" Also, the fries are poison.

It also takes on the fact that most web users ignore virtually all advertising, since so much of it is untrustworthy to a degree that old media rarely reached:

On TV, even if the ad is laced with misleading information (no, Axe Body Spray probably won't lead to instant female-on-male street rape), at least we know that the product is real. Toyota isn't selling you a cardboard car. If you order one of those stupid robe/blanket things, they're going to deliver that retarded, sex-repellant monstrosity to your house. The few ads that do reek of scam are the late night commercials (Enzyte, bullshit diet scams, one-year online colleges), and at least you know when they're coming. You can separate them from the legitimate products. On the net, you just have to assume that everything you see is out to screw you, the only exceptions being brands that you already know.

It's an entertaining read, and one that underlines one of the biggest ways online advertising is different from traditional advertising. When space was limited, the battle was for exposure; when space is unlimited, the battle is for trust and relevance in an increasingly uncertain and noisy world.

Filed Under: cracked, email, spam

e360's $11 Million Win Against Spamhaus... Now Reduced To Just $3 (Not $3 Million, But Just $3)

from the what-percentage-of-$135-million-is-that? dept

For about five years now, we've been following the bizarre case of email marketer e360 vs. Spamhaus. As you may know, e360 sued Spamhaus for defamation (and a few other things) for listing e360 as a spammer. You may have heard about e360 winning over $11 million dollars. You may have also heard about it asking for $135 million. And then there was a greatly reduced award of $27,000. Except now, the court has reduced the award down to $3. Yes, three whole dollars. It would appear that a court was not particularly impressed with e360. Let's review the history.

The whole lawsuit was silly, because Spamhaus' spam list is an opinion, not a factual statement. However, being a UK organization, Spamhaus (after initially engaging) decided to simply ignore the US judicial process, which resulted in the court granting a default judgment for over $11 million to e360. e360 then tried to force Spamhaus to shut down on the basis of that ruling, but the effort was rejected.

Around this time, Spamhaus decided to get back involved, asking for the default judgment to be set aside. The appeals court refused to do that, but did send the ruling back to the district court to figure out a way to more accurately determine damages. That resulted in the following, as summarized by Venkat Balasubramani at the link above:

Back at the district court, e360 was left with the task of proving up its damages, but it suffered a slew of discovery foibles. e360's principal failed to appear for his deposition as scheduled and failed to respond to Spamhaus's interrogatory requests. Spamhaus moved to dismiss on the basis of e360's discovery failures, and the trial court gave e360 another opportunity to address the discovery issues. e360 supplemented its previous responses but added a slew of new witnesses. It also increased its damages estimate from $11.7 million to a "whopping $135 million." It also sought to reopen discovery. The trial court said no dice and struck the new witnesses listed by e360 and struck e360's requested damage award to the extent it exceeded the initial $11.7 million request.

The court then reduced the award from $11 million down to $27,002. That didn't go over well with either party, and both appealed. Things definitely looked bad for e360 from the beginning of the appeal, with the respected Judge Posner positively berating e360's damages claims:

"I have never seen such an incompetent presentation of a damages case," Posner said. "It's not only incompetent, it's grotesque. You've got damages jumping around from $11 million to $130 million to $122 million to $33 million. In fact, the damages are probably zero."

That certainly provided a hint of what was to come. The award was reduced from the $27,002, down to a mere $3. Honestly, $3 seems even more mocking than if the court had taken it down to $0. The ruling details e360's incompetence in handling this lawsuit, especially the damages claims, which appear to have been made up entirely by the guy who runs e360 using a formula he himself created. It then rejects even the $27,000, saying that even damages of that amount do not appear to be supported by the evidence, and so concludes that the only reasonable award is a "nominal" award of $1 for each of the three charges, making the grand total $3. The judge even points out that e360's own conduct in the case resulted in "snatch[ing] defeat from the jaws of certain victory."

By failing to comply with its basic discovery obligations, a party can snatch defeat from the jaws of certain victory. After our earlier remand, all e360 needed to do was provide a reasonable estimate of the harm it suffered from Spamhaus’s conduct. Rather than do so, however, e360 engaged in a pattern of delay that ultimately cost it the testimony of all but one witness with any personal knowledge of its damages. That lone witness lost all credibility when he painted a wildly unrealistic picture of e360’s losses. Having squandered its opportunity to present its case, e360 must content itself with nominal damages on each of its claims, and nothing more. We VACATE the judgment of the district court and REMAND this matter with instructions to enter judgment for the plaintiffs in the amount of three dollars.

Priceless. Or, well, three bucks.

Filed Under: spam
Companies: e360, spamhaus

DailyDirt: Food That's Not Quite For Eating...

from the urls-we-dig-up dept

Parents everywhere are usually scolding their kids for playing with their food, but maybe kids are right to look at food as building materials and decorating items. Here are just a few unconventional uses for edible goods.

• SPAM Lip Glaze probably doesn't have the same shelf life as regular SPAM. But it's way more portable and would probably get by TSA security checkpoints. [url]
• Sun-dried squid bodies make nice little sake bottles that are traditionally called Ika Tokkuri. Who needs to worry about BPA-free or Phthalate-free plastics when you can just eat your drinking vessels? [url]
• Condiment wallpaper is a cheap (but perhaps not very long-lasting) way to decorate a room. And it looks better than filling nail holes in drywall with toothpaste... [url]
• To discover more food-related links, check out what's floating around in StumbleUpon. [url]  

By the way, StumbleUpon can also recommend some good Techdirt articles, too.

Filed Under: condiment, food, ika tokkuri, sake, spam, squid

Spamford Wallace Surrenders To The FBI; May Finally Go To Jail

from the wow dept

If you're an internet "old timer" who paid attention to the early "spam wars," you know the name of Sanford "Spamford" Wallace. While plenty of people have been described as "the spam king," he was the original kingpin (starting in the junk fax business, and then moving on to email in the mid-90s). He was proud of being called the spam king... but after the business started to become risky, he claimed that he "retired" in the late 90s, and (partially) owned a nightclub. However, the lure of the spam was apparently too much. He jumped into the spyware business and ran into trouble with the FTC. Things got weird when Wallace disappeared and his lawyer asked to withdraw from the case, noting that he couldn't reach Wallace. Wallace was hit with a massive fine from the FTC, which it appears he ignored.

He then moved on to spamming MySpace, which got him sued. His strategy was established: he just ignored the lawsuit. The end result? A $234 million fine. Of course, MySpace went downhill and up came Facebook. Facebook sued him in 2009 and won an astounding $711 million. This time, Wallace actually did show up in court, but claimed he was totally bankrupt. We wondered, at the time, if there was actually anything that could be done to stop him, since he seemed to just keep on spamming, and the fines (and some of the cases themselves) being issued against him were just ignored. There were some questions two years ago if he'd finally be brought up on criminal charges, and it appears that's finally happened.

Wallace apparently surrendered to the FBI after an indictment last month. He's now facing 40 years in jail and a potential $2 million fine (which seems like nothing compared to the earlier fines).

Some of the details in the article also suggest that Wallace simply couldn't stay away from Facebook, despite a court order not to access the site at all:

Wallace, who was ordered by U.S. District Court Judge Jeremy Fogel in 2009 not to access Facebook, was also charged with violating that order by accessing the social network on an airline flight from Las Vegas to New York in April 2009 and by maintaining an account under the name David Sinful-Saturdays Fredericks for a few weeks earlier this year.

I will say that 40 years sounds excessive. However, it also seems clear that he has no interest in following the law when it comes to these things.

Filed Under: arrested, sanford wallace, spam, spamford
Companies: facebook, myspace

Kindle Spam Is A Filter Issue, Not A Spam Issue

from the filter-away dept

Via Slashdot, we learn that spammers have discovered the ability to publish cheap "ebooks":

Thousands of digital books, called ebooks, are being published through Amazon’s self-publishing system each month. Many are not written in the traditional sense.

Instead, they are built using something known as Private Label Rights, or PLR content, which is information that can be bought very cheaply online then reformatted into a digital book.

These ebooks are listed for sale – often at 99 cents – alongside more traditional books on Amazon’s website, forcing readers to plow through many more titles to find what they want.

The article makes it sound like this is a big problem, calling it "the dark side" of self-publishing, but I don't get it. Assuming no one wants this crap, then it seems likely that Amazon will start to filter it out of any search results or top lists.

There is some slightly more legitimate concern about outright plagiarism, where some of these "spammers" are merely copying other books and then re-branding them and selling them as ebooks. But, once again, this seems like a filter problem more than anything else. In fact, I'm a bit surprised that Amazon doesn't do a basic check to make sure the content of an ebook hasn't already been offered by someone else, and do a further investigation if that's the case. Others have suggested that Amazon charge a small fee to upload a book, as that might prevent spammers from going crazy with such copies, and that could make sense as well. I just have trouble believing that this is such a serious "problem" that it can't easily be stopped.

Filed Under: ebooks, kindle, spam
Companies: amazon

JC Penney Feels The Wrath Of Google For Using Spammy Techniques To Get To The Top

from the don't-mess-with-the-goog dept

Over the weekend there was a fascinating NY Times article about how retailing giant JC Penney apparently had a massive black hat search spam campaign going, which put its homepage at the top of a ton of beneficial searches. In digging into it, the NY Times uncovered a lot of questionable behavior, and Google quickly responded by implementing some sort of "corrective behavior" that sank JC Penney listings. This is slightly less severe than the famous time that Google dumped BMW's domain for a period of time after that company was caught spamming. JC Penney, for its part, denies having authorized such a campaign, and apparently fired the search engine optimization company it had been working with.

Of course, there's all sorts of vague statements in the article, and it's not clear how Google meted out this punishment. Of course, since it's listed as a "manual action," it's going to get some anti-Google folks up in arms about how Google "manually" can and does adjust search results -- a point of anger that has been brought out before. But it's not clear that's actually what's going on, and even if there is a "manual" punishment functionality for spamming the Google index, isn't that a good thing? Shouldn't we want Google to be punishing companies that make the search results worse?

Filed Under: search engine optimization, seo, spam
Companies: google, jc penney

California Appeals Court Says Company Can Be Held Liable For Spam It Didn't Write Or Know About

from the that-doesn't-make-any-sense dept

In a ruling that Eric Goldman correctly refers to as "divorced from reality," a California Appeals court has ruled that two advertising firms can be held liable for actions done by their affiliates (and sub-affiliates). In this case, these sub-affiliates sent out spam, advertising things on behalf of the defendants in the case. There were a few legal questions raised by the case, including yet another attempt to see if CAN SPAM really pre-empts state anti-spam laws, which are interesting, but which we won't discuss right now. Instead, I wanted to focus on that one key issue of putting the blame on a company for what a third party does.

This is a key point that we've been raising a lot around here lately, as more and more people look to blame third parties, often because it's (a) easier and (b) those third parties have more money. While I recognize that we all get annoyed by spam, a ruling of this nature is completely misdirected. It means that if you want to get a company in trouble, just send spam advertising their stuff to California residents. Now those firms are liable for your statements even if it had no idea that you were doing this. Goldman warns that this ruling will "generate lots more of wasteful profit-seeking litigation."

Both Venkat and Eric in the link above question how this ruling could survive a Section 230 analysis -- which should present a perfectly valid safe harbor for the two firms in question. It's not clear if either firm even raised a Section 230 defense, but even without that, I'm troubled by the fact that the court didn't seem to comprehend that it was blaming a company for actions of someone they have no control over. The court -- incorrectly -- claims that this could lead to "take a more active role in supervising" actions of affiliates, but as Eric points out, the strict liability standard put forth by the court means that no matter how active a role they take, if one spam message slips through, they're still liable. That doesn't lead to a more active role in supervising, it leads companies to dump such programs altogether:

Because of strict liability, even advertisers who undertake substantial efforts to police their affiliate network ARE STILL LIABLE FOR ANY PROBLEMS CREATED BY AFFILIATES. Maybe the court got confused about what it meant to impose STRICT LIABILITY. In reality, many advertisers won't rely on affiliates at all if they are strictly liable for what they do. I bet this court would view that as a perfectly fine outcome, but the it's disingenuous to say that strict liability will ratchet up the policing effort. A negligence standard might have done that; strict liability squashes the endeavor altogether.

This is definitely a worrisome trend, as we've seen a growing number of courts get tripped up on ideas surrounding third party liability, not recognizing the consequences of those rulings.

Filed Under: california, liability, spam

Latest Google Spam Technique: Invent Fake Street Addresses And Show Up In Google Listings

from the spam-spam-spam-spam dept

John Nagle, who famously highlighted the massive problems with Craigslist spam a few years ago, alerts us to his latest report, showing how Google's regular listings are getting filled up with Google Places spam (pdf). Apparently, Google integrated its Places offering into Google's regular search back at the end of October, and almost immediately various search engine optimizers (both the "white hats" and the "black hats") almost immediately realized that it was really easy to game the system: you just create a "business" at a fake, but real-sounding, address. Some companies are quite upfront about how to do this:

1. Set up a listing in Google Maps at an address that does not currently exist. For example, where there is a 60 Main St., Anytown and a 64 Main St, Anytown and these represent real addresses. Set up your listing at 62 Main St.
2. Name your business USKeyword-City, or Keyword-Pro-city or Fictitious name of person plus keyword for the personal touch.
3. Build citations to your listing. These listings contain citations from Yahoo Local, Hotfrog, Guidespot, local.newstimelive.com.
4. Create a blog on one of the sites for the purpose of creating a perfect citation for thousands of listings.
5. Link build
6. Give your new listing a sparkling review
7. Now find an adjacent town and repeat. Again and again and again again

There are even apparently tools on the market that will help you do this. The report notes that this is apparently so effective that the search engine optimizers who usually play by the rules (the "white hat" SEOs) are even making use of it as well. Of course, this has also opened up new business opportunities for some. According to the report, a convenience store chain in New York is effectively "selling" its address to others to use to get on Google in this manner.

Apparently, the more aggressive, less ethical "black hat" SEOs are seeking to take this to a new level, with new software on the way that will make it easier to bypass various attempts by Google to control this and, at the same time, use spamming engines to write fake "reviews" for these spammed "businesses."

As the report notes, there are two key areas of weakness in the way Google has implemented this:

The two phases of spamming Google Places are the insertion of fake business locations and the creation of fake reviews. Both are embarrassingly easy using the techniques described above.

Google Places obtains business locations from web pages created by the business itself, advertising directories ("Yellow Pages") entries paid for by the business, and from "place pages", also created by the business itself. There is little if any verification against objective data sources, such as business licenses, corporation registrations, and business credit rating services such as Dun and Bradstreet. This makes it possible to create fake Google Places entries.

Recommendations are obtained from recommendation web sites. Most recommendation sites allow free account creation and have little information about their members, so the cost of creating phony identities for recommendation spam is low. Because the typical local business has a relatively small number of recommendations, only a few phony recommendations are needed to promote an individual business location.

Considering how much work has been done by SEO folks in just a few months, it will be interesting to see how Google responds. The company has always promoted its "anti-spam" efforts, but it sounds like not much forethought was put into the Places integration.

Filed Under: google places, spam
Companies: google