Cynthia Dyer-Bennet (cdb) Wed 26 Jan 05 11:36
Today we're pleased to welcome Brian McWilliams, author of "Spam Kings: The Real Story Behind the High-Rolling Hucksters Pushing Porn, Pills and @*#?% Enlargements" -- a fascinating exploration into the strange and sometimes disturbing world of bigtime spammers. Brian (www.brianmcwilliams.com) is an investigative journalist who's been writing about business and technology for more than a decade. His work has appeared at Salon.com, Wired News, PC World, and Computerworld, and he is a correspondent for New Hampshire Public Radio. McWilliams gained international attention in 2002 when he wrote about the contents of Saddam Hussein's email in-box for Wired News. McWilliams received an MFA in writing from Cornell University in New York and a B.A. from Hampshire College in Massachusetts. He lives in Durham, New Hampshire. "Spam Kings," published in November 2004, is his first book. Joining Brian is David Adam Edelstein. David is a photographer (http://www.noise-to-signal.com) and amateur student of culture and society. In his free time he works as a user interface designer for a Large Software Company in Washington state. Since he grew up in Hawai'i and also has an e-mail address, his experience with spam and Spam(tm) is extensive. Welcome, Brian and David. We're delighted to have you here in Inkwell and we're eager to see how this conversation develops over the next two weeks.
David Adam Edelstein (davadam) Wed 26 Jan 05 14:21
Glad to be here. Brian's book is a fascinating look into both sides of the spam wars, putting a very human face on something that most of us have only experienced as something annoying or occasionally amusing we're deleting out of our inboxes ("Hey hon, would you love me more if I was punishing you with my enormous weapon?"). Brian, I'd like to start out by talking about the people most of us consider the "bad guys" in this story. What is it that makes a typical spammer? Why doesn't every money-hungry nerd go this route? I suppose we can go at that question by looking at Davis Hawke, the anti-hero of Spam Kings. Do you think there's a natural progression from his being a neo-nazi to being a spammer? Do other spammers you've looked at share significant personality characteristics with him?
Brian McWilliams (bmcwilliams) Wed 26 Jan 05 17:22
Hello Cynthia, David, and InkWell readers, Thanks for having me as your guest. Do spammers have a common modus operandi? I profile about a dozen of them in Spam Kings, and they are a strikingly diverse group in terms of age, sex, socio-economic background, education, etc. Almost all of them saw the Internet boom and wanted to cash in somehow. I think the digital gold rush created some great ideas, but it also brought out the worst in some people. If there's one trait that shows up in a lot of the spammers I've met, it's laziness. They're attracted to the power of email, the ability to broadcast messages to millions of people for very little cost and effort. Hawke used to boast to me about his laziness, about how he was rolling in dough but only worked a couple hours a day. (As I report in the book, that left him plenty of time for tennis, chess, and his live-in prostitute from Columbia.) Many spammers also seem to have an outsider mentality. (Maybe it's because most Internet users hate them?) Even after Hawke gave up being a neo-Nazi in 1999 and turned to spamming, he still had no desire to engage with society or the economy in a normal way. That's a strange trait in a guy who, under slightly different circumstances, might have ended up a doctor or lawyer. (Hawke grew up in an upper middle-class family in the Boston suburbs. He was an honors student. His grandfather was a VP at MIT. His mother was a descendant of a woman who turned down a marriage proposal from Thomas Jefferson. Etc.) But the most important thing that spammers seem to have in common is a belief that online consumers want what they have to offer, but "anti-spammers" and the law are standing in the way. Spammers claim that they wouldn't have to resort to stealth tactics if it weren't for anti-spammers trying to sabotage their businesses.
David Adam Edelstein (davadam) Wed 26 Jan 05 23:23
I suppose, at some tiny percentage, they're right, too. People do buy product, or Hawke and his colleagues couldn't pay for their servers, let alone tennis and a live-in prostitute. I suppose that also speaks to your comment about the digital gold rush bringing out the worst in some people. Most of the products the spammers sell -- rapid weight loss, penis enlargement, fake rolexes, get a free computer for participating -- seem to be in the classic "something for nothing" category, that exhibit hall at the country fair where the no-effort car waxes and ever-sharp knives are sold. And as you show in the list of customers of one spammer, all kinds of people want to get that something. Is it that the web allows people to be their secret selves, and that some of them are greedy, and others are insecure? What is it that makes people think it's a good idea to send their credit card number to a spammer? As a side note to that question, one of the things that surprised me the most was that the spammers are actually sending out product -- I had always assumed they were just harvesting credit card numbers and running. So clearly they have some kind of ethics; or is it just harder to get prosecuted when you actually send out product?
Brian McWilliams (bmcwilliams) Thu 27 Jan 05 10:27
I was surprised to learn, while researching Spam Kings, that lots of consumers are buying from spammers. I discovered that Hawke was taking in around $500K per month in the summer of 2003 from sales of Pinacle, an herbal Viagra pill that he marketed as a penis extender. A few weeks ago, Forrester Research published results of a survey in which 41% of U.S. Internet users said they had bought something in response to junk email. In the book, I argue that many spammers are tapping into a market of what I call furtive shoppers. The Internet gives spammers the anonymity they need to do business online, but it also gives consumers a similar cover. As you mentioned, Hawke's customers included people from all walks of life -- CEOs, mutual fund managers, veterinarians, and lacrosse coaches. Few of these people would have walked into their local pharmacy and asked, "Do you carry those pills guaranteed to grow your penis three inches in two weeks?" Yet they were willing to suspend disbelief online and hand over their credit card numbers to Hawke and his partner. Yes, Hawke's company, Amazing Internet Products, was pretty dutiful about shipping out product. But even so, I found plenty of unhappy customers with no place to turn. Like a lot of spam operations, Amazing didn't list its phone numbers or even an email address at its sites. And even when a spam operation is delivering the goods, it's likely built on fraud. And I'm not just talking about the bogus product claims. Most spam messages use forged routing headers, fake "from" addresses, and other tricks to hide the true sender.
David Adam Edelstein (davadam) Thu 27 Jan 05 13:31
Holy cow, 41%. That's no tiny percentage, then. With that kind of market, is it worth the effort to fight against the spammers themselves? I know that argument has been brought up regarding anti-drug programs that target growers, manufacturers and/or dealers -- that as long as there's a market, there will be people to exploit it. Do you think that holds true in this case? Is it possible to run, say, a public education campaign that might change people's furtive shopping habits?
Brian McWilliams (bmcwilliams) Thu 27 Jan 05 20:34
Is it worth the effort to fight spammers? The heroine of my book, a California anti-spammer who goes by the nickname Shiksaa, certainly asks herself that after four years of digital trench-warfare with junk e-mailers. (Especially after they post close-up photos of her house, along with her address and phone number, on a Web site.) Some people -- especially the folks who favor technological solutions -- say the battle should be depersonalized. The enemy is spam, not spammers. In any case, there *was* an industry effort in 2003 to get consumers to kick the spam habit and just hit delete instead. But it never really took off. ( http://www.iia.net.au/news/090302.html .) I think consumer education will eventually occur without the help of such programs. Most spammers don't get a lot of repeat business. Consumers wise up pretty fast after their first experience with a spamvertised product. (Then again, I recall hearing something about suckers being born every minute ... )
David Adam Edelstein (davadam) Fri 28 Jan 05 06:59
Hah! Yes, there is that -- although I also have to consider Mr. Barnum's other famous line, "You can't fool an honest man". Let's turn to the other side of the battle -- the anti-spammers. Shiksaa, the anti-spammer you focus on, is fascinating to me. Not terribly technical, at least at the beginning, she dives in and learns what she needs because she's just that angry. In our conversation a couple of days ago, you suggested that she didn't really want to be included in the book. Why is that? And why make her the heroine, in that case?
Brian McWilliams (bmcwilliams) Fri 28 Jan 05 12:01
>Shiksaa, the anti-spammer you focus on, is fascinating to me. Not >terribly technical, at least at the beginning, she dives in and >learns what she needs because she's just that angry. Yes, Spam Kings is almost as much about Shiksaa as it is about Hawke or Scott Richter or Tom Cowles or the other spam kings. It's the story of her rise in the spam-fighting ranks. We see spammers through her eyes (or at least through her interactions with them). In many ways, she's the opposite of Hawke. The phrase "fiercely principled" comes to mind ... Shiksaa is an amazing sleuth -- everyone says that, including the spammers. As you say, she's not real technical, but she knows some tricks that enable her to dig up dirt on spammers who are sloppy. She's also good at getting spammers to talk to her, perhaps in part because she's female. As a result of her high profile, Shiksaa has taken a lot of flack from spammers over the years. She was a tough cookie to start, but now she is even more hardened as a result of her anti-spam work. A few years ago, she seemed to think she could teach spammers that they've gone wayward. But she came to believe that it's impossible to reform a spammer. >In our conversation a couple of days ago, you suggested that she >didn't really want to be included in the book. Why is that? And why >make her the heroine, in that case? When I was researching the book, everyone kept telling me about this uber-antispammer named Shiksaa. As I looked over the key events of the past five years, she often seemed to be at the center of the action. I came to realize that it would be a huge historical oversight not to include her in the book. Over time, I decided that telling her story would be a great way of personifying the topic of anti-spamming, in the same way that focusing on Hawke's rise and fall could give readers a good insight into the ways of the spammer. Shiksaa was conflicted about being the center of the story, partly out of modesty, and partly out of concern that the book would subject her to more reprisals. Still, she gave me hours of interviews. When I told her I had decided to make her the book's heroine, she wasn't happy, and she told her colleagues not to talk with me. But she continued telling me about her story. When O'Reilly put a sample of Spam Kings online last fall, she complained loudly in the Nanae newsgroup about how she was depicted. But after the book came out and she read the copy I sent her, Shiksaa thanked me and asked for two additional copies so she could give them to relatives. So, in the end, I hope things have turned out OK.
Cynthia Dyer-Bennet (cdb) Fri 28 Jan 05 12:34
(NOTE: If you're reading this from offsite, you can send your comments or questions to <email@example.com> to have them added to the conversation.)
John Brewer (jbrewer) Fri 28 Jan 05 12:41
I'm curious. Do spammers typically break the law (apart from anti-spam legislation)? I saw a story yesterday about Earthlink winning a "substantial" settlement from the "Alabama Spammers", who were commiting identity theft in order to get Earthlink accounts to spam with. Is this typical?
Brian McWilliams (bmcwilliams) Fri 28 Jan 05 13:01
>Do spammers typically break the law (apart from anti-spam >legislation)? John, if you mean, do spammers breaks laws in addition to anti-spam laws, the answer is often yes. A number of spammers have been tripped up for crimes including fraud, identity theft, etc. (Howard Carmack, the so-called "Buffalo Spammer" is one example.) Jason Vale, one of the main figures in Spam Kings, ignored a spam lawsuit from AOL but was finally put out of business (and into jail) for violating a consent agreement with the Food and Drug Administration. Vale had been sending spams for apricot seeds (a.k.a. Laetrile) as a cancer cure. (He believed the seeds had cured his own cancer, and, freed of a big tumor, went on to become a champion arm wrestler.) Vale is now serving a five-year jail term for contempt of court.
Dan Mitchell (mitchell) Fri 28 Jan 05 14:33
Brian, this was a great book. In fact, I'm at a little bit of a disadvantage here because I got the book a month ago, and read it within a few days, because i could not put it down, so it's not as fresh in my mind as I would like. I say this with some chagrin. I have for years been thinking and talking about doing a book, or at least a long magazine story, like this. But I just never really got serious about it. I interviewed Shiksaa briefly for a story I did last year, and she was *way* skittish about talking to me at all. Said she'd been burned by journalists in the past. So, good going, getting her to open up like she did. I have lots of questions, but I'll start with this: You handled tone really well here -- straight narrative without a lot of commentary on your part. You seemed to realize that showing trumped telling here even moreso than in most stories. You didn't need to characterize scumbaggery as scumbaggery -- the Spam Kings did it themselves, through their actions. So, on those rare occassions where you *did* drop in a little commentary, it really worked. But the book never really got around to directly confronting these people on their lack of scruples. Did they feel bad about what they did? How did they feel about the fact that everybody hates their guts? How do they feel about the fact that they annoy people for a living? Did they even think about this? And what were the root causes of this particular pathology? What psychological dysfunctions do spammers share, if any? You do address this stuff, but only in kind of a glancing way. I would say it's one of the few flaws (if it can even be called that) in the book -- it was never really explicated. Was this something you gave a lot of thought to? Was it a conscious choice. Thanks for coming here to do this, by the way.
Brian McWilliams (bmcwilliams) Fri 28 Jan 05 15:18
Dan, thank you for reading Spam Kings. I'm honored to get praise from such an accomplished writer. >But the book never really got around to directly confronting these >people on their lack of scruples. That is a very interesting observation. I admit that I never directly asked any of the spammers whether they felt remorse about being spammers! I'm no shrink, but the spammers I profiled do tend to exhibit some interesting coping behaviors, if not outright pathology. Consider, for example, their rejection of the label "spammer." They tend to prefer the term "bulker" instead. Scott Richter even goes so far as to call himself a "high-volume e-mail deployer." Spammers also tend to blame their problems on "antis" -- as if spam was only a problem for a strident minority. Ultimately, the allure of money seems to steel these people against criticism. As Doctor Fatburn tells Shiksaa at one point, "I make more money in one day than you'll make in your entire pathetic life." (Or something along those lines.)
David Adam Edelstein (davadam) Sat 29 Jan 05 00:09
Mr. Richter's insistence on distinguishing himself from the other spammers did strike me as funny. Is there a pecking order among spammers? Do they have a sense of "well, I send bulk e-mail, but at least I don't X"?
Brian McWilliams (bmcwilliams) Sat 29 Jan 05 08:15
Richter insists that the recipients of his emails "opted in" to receive them, and that his company is dutiful about removing anybody who wants off his lists. Richter also buys or rents network addresses for sending his email and hosting his web sites. As such, Richter obviously is in a different league than a spammer who simply harvests addresses off web pages, sends his spam through hacked third-party computers, and doesn't honor unsubscribe requests. (As I describe in Spam Kings, Davis Hawke bought a lot of his addresses from an AOL employee who stole AOL's member database and sold it to spammers, and he sent most of his spam through "proxy" computers in order to hide his tracks.) But the lowest of the low would be the "phishing" spammers who broadcast those bogus emails that look like they're from banks and ask recipients to confirm their account information.
David Adam Edelstein (davadam) Sat 29 Jan 05 08:27
My question is more towards "do the spammers themselves make a distinction?" Do they consider phishing the lowest of low? That leads to another question I have: How much sharing and/or copying of technique goes on between spammers? In the book, Davis Hawke copies and modifies the text of some spams he receives himself. Does that go on a lot? Is there any deliberate sharing, a sort of professional development organization? Maybe I'm imagining too much organization on their part :-) For example, when I get fake rolex ads for a couple of weeks, is that one spammer, or is it several spammers trying the same technique?
Brian McWilliams (bmcwilliams) Sat 29 Jan 05 20:02
>My question is more towards "do the spammers themselves make a >distinction?" Do they consider phishing the lowest of low? David, sorry. The "opt-in" spammers definitely see themselves as distinct. The rest look down on the phishing scammers ... but they also may depend on them for a steady supply of proxies. Many of the people running the phishing schemes also control the big "botnets" of hacked computers that are used today to send about 60% of all spam. To most spammers, the most important distinction is between who's making lots of money and who isn't. >Is there any deliberate sharing, a sort of professional development >organization? Definitely. Spammers congregate in online spamming forums, where they do business deals and trade information. Some also participate in private mailing lists set up by vendors of spam software. In recent weeks, two popular forums, SpecialHam.com and SpamForum.biz, have been booted by their web hosting companies. But they'll no doubt resurface again soon. Archive.org has a copy of the front page of SpecialHam.com here: http://web.archive.org/web/20031002015930/www.specialham.com/specialham/ >when I get fake rolex ads for a couple of weeks, is that one spammer, >or is it several spammers trying the same technique? Hard to say without seeing the particular spams. Many spammers hire affiliates and pay them a commission to send e-mails. The "sponsors" typically provide ad copy to affiliates. So you may get several spams for the same replica watch site, each from a different affiliate.
Dan Mitchell (mitchell) Sun 30 Jan 05 09:32
Of course, "opt-in" spammers are lying that most of the people they spam have opted in to anything. They may be lying to themselves, as I think Richter may be, but they are lying nonetheless.
David Adam Edelstein (davadam) Sun 30 Jan 05 10:19
I suspect that if you're in the business at all, and you think that it's about anything besides money by any means possible, then you're lying to yourself at some level :-) Brian, that link to the archive of the specialham site reminds me that I wanted to talk a bit about the process of writing this book. I haven't seen one before where so much of the research was from archived web sites, Usenet posts, and so forth. It was fascinating to be able to go to google groups and read some of the threads in nanae myself: The actual chat transcripts that were posted, Richter's blustering posts... Do you think using so many Usenet postings as source material affected how you wrote the book? Was it a good thing?
Brian McWilliams (bmcwilliams) Sun 30 Jan 05 15:47
>I wanted to talk a bit about the process of writing this book. I >haven't seen one before where so much of the research was from >archived web sites, Usenet posts, and so forth. David, yeah, I'm probably one of the first authors to mention Google Groups and Archive.org in her or her acknowledgments. :) Most spammers (and anti-spammers too) don't want to draw any attention to themselves. So researching Spam Kings was a challenge. Hawke was particularly paranoid. Here's a guy who constantly uses aliases, ever-changing phone numbers, post-office boxes, email accounts. What possible benefit would any spammer gain from being in my book? I eventually wore Hawke down after nearly a year of following him around. (At one point, he wanted me to promise I'd put his photo on the cover.) I reconstructed a lot of the stories in Spam Kings from the usual source material most investigative journalists rely on: court records, interviews, business documents, articles, etc. But I did end up relying heavily on Internet sources such as newsgroups, archived web sites, domain registrations, and chat logs. Much of the story also came from the spams themselves, copies of which had been stored in newsgroups and on the web. >Do you think using so many Usenet postings as source material >affected how you wrote the book? Was it a good thing? It made me conscious of the fact that, to some extent, I was writing a cultural history, and that others could easily go to Google and independently verify my description of certain events. I actually liked being in that situation. It's liberating to have publicly accessible documentation to back up your story. But I made a decision early on not to reproduce chat logs and newsgroup conversations in their original format. I didn't want to foreground the medium from which I snagged the material. Instead, whenever possible, I tried to reformat conversations as conventional narrative dialogue.
Brian McWilliams (bmcwilliams) Sun 30 Jan 05 16:23
>"opt-in" spammers are lying that most of the people they spam have >opted in to anything. Dan, it's true that many people probably don't realize that they have opted in to spam lists (particularly when the spammers don't use a "double opt-in" system, in which recipients have to confirm their interest.) But in looking over the numerous pages of exhibits provided in NY vs Richter et al., I was amazed at the ingenious ways that the marketers were duping people to opt in. I mean, who could resist a free copy of the "Girls Gone Wild" DVD? (Never mind the fine print that says that, in accepting the offer, you are giving marketers permission to bombard your inbox.)
David Adam Edelstein (davadam) Mon 31 Jan 05 14:37
I've noticed a definite generational difference among people I know. There's a growing number of younger people who think that getting a free ipod (or even a copy of Girls Gone Wild) is a perfectly acceptable trade for some extra spam. I'm not sure why that is -- possibly because they treat e-mail addresses as disposable? That does bring up another (devil's advocate) question that's central to any debate about spam: Is it really that big of a deal? Assuming you're not paying by the minute, and assuming you're not getting hundreds of spams a day, what's the big deal about deleting 20-30 messages? Or, asked in a less provocative way, what is there that's so offensive about spam that would cause people to spend so much time tracking down spammers? Is it just another hobby?
John Brewer (jbrewer) Mon 31 Jan 05 14:41
Actually, given the effacacy of my current spam filter, a free iPod might be worth it.....
Dan Mitchell (mitchell) Mon 31 Jan 05 16:35
I've concluded that -- beyond the simple annoyance factor, which is the main thing -- there is also this: spammers are scumbags and hucksters. They sell sleazy, scummy products in a sleazy, scummy way. And I simply don't want them contacting me or having anything to do with me. *Especially* on my computer, which I consider sacred, private ground: my domain. But beyond that, I get about 300 spams a day at this point. I have a two-belts-and-suspenders set of filters that means that now, only 3 or 4 end up making it all the way to my inbox. But I still have to scroll through all the crap to make sure I didn't miss anything legit. Why should vermin like Richter get even a *nanosecond* of my time? Also, don't forget the costs to ISPs and private networks -- borne by businesses and private net users alike. It's just astronomical.
Dan Mitchell (mitchell) Mon 31 Jan 05 19:22
Brian, I did a quick scan on some of the reax to the book in Nanae. Wow, some people are stupid. Among other idiocies, several people are saying that shiksaa should sue you because you used her in the book without paying her. Like, several people. What's the reaction been like from you perspective, both from spammers, antis, and everyone else, for that matter?
Members: Enter the conference to participate