Inkwell: Authors and Artists

    
Today we're pleased to welcome Brian McWilliams, author of "Spam Kings:
The Real Story Behind the High-Rolling Hucksters Pushing Porn, Pills
and @*#?% Enlargements" -- a fascinating exploration into the strange 
and sometimes disturbing world of bigtime spammers.

Brian (www.brianmcwilliams.com) is an investigative journalist who's been
writing about business and technology for more than a decade. His work has
appeared at Salon.com, Wired News, PC World, and Computerworld, and he is a
correspondent for New Hampshire Public Radio.

McWilliams gained international attention in 2002 when he wrote about the
contents of Saddam Hussein's email in-box for Wired News. McWilliams
received an MFA in writing from Cornell University in New York and a B.A.
from Hampshire College in Massachusetts. He lives in Durham, New Hampshire.
"Spam Kings," published in November 2004, is his first book.

Joining Brian is David Adam Edelstein. David is a photographer
(http://www.noise-to-signal.com) and amateur student of culture and society.
In his free time he works as a user interface designer for a Large Software
Company in Washington state.  Since he grew up in Hawai'i and also has an
e-mail address, his experience with spam and Spam(tm) is extensive.

Welcome, Brian and David. We're delighted to have you here in Inkwell and
we're eager to see how this conversation develops over the next two weeks.
  

    
Glad to be here.  Brian's book is a fascinating look into both sides
of the spam wars, putting a very human face on something that most of
us have only experienced as something annoying or occasionally amusing
we're deleting out of our inboxes ("Hey hon, would you love me more if
I was punishing you with my enormous weapon?").  

Brian, I'd like to start out by talking about the people most of us
consider the "bad guys" in this story.  What is it that makes a typical
spammer?  Why doesn't every money-hungry nerd go this route?

I suppose we can go at that question by looking at Davis Hawke, the
anti-hero of Spam Kings.  Do you think there's a natural progression
from his being a neo-nazi to being a spammer?  Do other spammers you've
looked at share significant personality characteristics with him?
  

    
Hello Cynthia, David, and InkWell readers,

Thanks for having me as your guest.

Do spammers have a common modus operandi? I profile about a dozen of
them in Spam Kings, and they are a strikingly diverse group in terms of
age, sex, socio-economic background, education, etc.  Almost all of
them saw the Internet boom and wanted to cash in somehow.

I think the digital gold rush created some great ideas, but it also
brought out the worst in some people. If there's one trait that shows
up in a lot of the spammers I've met, it's laziness. They're attracted
to the power of email, the ability to broadcast messages to millions of
people for very little cost and effort. Hawke used to boast to me
about his laziness, about how he was rolling in dough but only worked a
couple hours a day. (As I report in the book, that left him plenty of
time for tennis, chess, and his live-in prostitute from Columbia.)

Many spammers also seem to have an outsider mentality. (Maybe it's
because most Internet users hate them?) Even after Hawke gave up being
a neo-Nazi in 1999 and turned to spamming, he still had no desire to
engage with society or the economy in a normal way. 

That's a strange trait in a guy who, under slightly different
circumstances, might have ended up a doctor or lawyer. (Hawke grew up
in an upper middle-class family in the Boston suburbs. He was an honors
student. His grandfather was a VP at MIT. His mother was a descendant
of a woman who turned down a marriage proposal from Thomas Jefferson.
Etc.)

But the most important thing that spammers seem to have in common is a
belief that online consumers want what they have to offer, but
"anti-spammers" and the law are standing in the way. Spammers claim
that they wouldn't have to resort to stealth tactics if it weren't for
anti-spammers trying to sabotage their businesses.
  

    
I suppose, at some tiny percentage, they're right, too.  People do buy
product, or Hawke and his colleagues couldn't pay for their servers,
let alone tennis and a live-in prostitute.

I suppose that also speaks to your comment about the digital gold rush
bringing out the worst in some people.  Most of the products the
spammers sell -- rapid weight loss, penis enlargement, fake rolexes,
get a free computer for participating -- seem to be in the classic
"something for nothing" category, that exhibit hall at the country fair
where the no-effort car waxes and ever-sharp knives are sold.  And as
you show in the list of customers of one spammer, all kinds of people
want to get that something.  Is it that the web allows people to be
their secret selves, and that some of them are greedy, and others are
insecure?  What is it that makes people think it's a good idea to send
their credit card number to a spammer?

As a side note to that question, one of the things that surprised me
the most was that the spammers are actually sending out product -- I
had always assumed they were just harvesting credit card numbers and
running.  So clearly they have some kind of ethics; or is it just
harder to get prosecuted when you actually send out product?
  

    
I was surprised to learn, while researching Spam Kings, that lots of
consumers are buying from spammers.  I discovered that Hawke was taking
in around $500K per month in the summer of 2003 from sales of Pinacle,
an herbal Viagra pill that he marketed as a penis extender. A few
weeks ago, Forrester Research published results of a survey in which
41% of U.S. Internet users said they had bought something in response
to junk email.

In the book, I argue that many spammers are tapping into a market of
what I call furtive shoppers. The Internet gives spammers the anonymity
they need to do business online, but it also gives consumers a similar
cover. 

As you mentioned, Hawke's customers included people from all walks of
life -- CEOs, mutual fund managers, veterinarians, and lacrosse
coaches. Few of these people would have walked into their local
pharmacy and asked, "Do you carry those pills guaranteed to grow your
penis three inches in two weeks?" Yet they were willing to suspend
disbelief online and hand over their credit card numbers to Hawke and
his partner. 

Yes, Hawke's company, Amazing Internet Products, was pretty dutiful
about shipping out product. But even so, I found plenty of unhappy
customers with no place to turn. Like a lot of spam operations, Amazing
didn't list its phone numbers or even an email address at its sites. 

And even when a spam operation is delivering the goods, it's likely
built on fraud. And I'm not just talking about the bogus product
claims. Most spam messages use forged routing headers, fake "from"
addresses, and other tricks to hide the true sender. 
  

    
Holy cow, 41%.  That's no tiny percentage, then.

With that kind of market, is it worth the effort to fight against the
spammers themselves? I know that argument has been brought up regarding
anti-drug programs that target growers, manufacturers and/or dealers
-- that as long as there's a market, there will be people to exploit
it.  

Do you think that holds true in this case?  Is it possible to run,
say, a public education campaign that might change people's furtive
shopping habits?  
  

    
Is it worth the effort to fight spammers? The heroine of my book, a
California anti-spammer who goes by the nickname Shiksaa, certainly
asks herself that after four years of digital trench-warfare with junk
e-mailers. (Especially after they post close-up photos of her house,
along with her address and phone number, on a Web site.)  

Some people -- especially the folks who favor technological solutions
-- say the battle should be depersonalized. The enemy is spam, not
spammers. 

In any case, there *was* an industry effort in 2003 to get consumers
to kick the spam habit and just hit delete instead. But it never really
took off. ( http://www.iia.net.au/news/090302.html .) 

I think consumer education will eventually occur without the help of
such programs. Most spammers don't get a lot of repeat business.
Consumers wise up pretty fast after their first experience with a
spamvertised product. (Then again, I recall hearing something about 
suckers being born every minute ... )
  

    
Hah! Yes, there is that -- although I also have to consider Mr.
Barnum's other famous line, "You can't fool an honest man".

Let's turn to the other side of the battle -- the anti-spammers. 
Shiksaa, the anti-spammer you focus on, is fascinating to me.  Not
terribly technical, at least at the beginning, she dives in and learns
what she needs because she's just that angry.  

In our conversation a couple of days ago, you suggested that she
didn't really want to be included in the book.  Why is that?  And why
make her the heroine, in that case?
  

    
>Shiksaa, the anti-spammer you focus on, is fascinating to me.  Not
>terribly technical, at least at the beginning, she dives in and
>learns what she needs because she's just that angry.  

Yes, Spam Kings is almost as much about Shiksaa as it is about Hawke
or Scott Richter or Tom Cowles or the other spam kings. It's the story
of her rise in the spam-fighting ranks. We see spammers through her
eyes (or at least through her interactions with them). In many ways,
she's the opposite of Hawke. The phrase "fiercely principled" comes to
mind ...

Shiksaa is an amazing sleuth -- everyone says that, including the
spammers. As you say, she's not real technical, but she knows some
tricks that enable her to dig up dirt on spammers who are sloppy. She's
also good at getting spammers to talk to her, perhaps in part because
she's female. 

As a result of her high profile, Shiksaa has taken a lot of flack from
spammers over the years. She was a tough cookie to start, but now she
is even more hardened as a result of her anti-spam work. A few years
ago, she seemed to think she could teach spammers that they've gone
wayward. But she came to believe that it's impossible to reform a
spammer.

>In our conversation a couple of days ago, you suggested that she
>didn't really want to be included in the book.  Why is that?  And why
>make her the heroine, in that case?

When I was researching the book, everyone kept telling me about this
uber-antispammer named Shiksaa. As I looked over the key events of the
past five years, she often seemed to be at the center of the action. I
came to realize that it would be a huge historical oversight not to
include her in the book. 

Over time, I decided that telling her story would be a great way of
personifying the topic of anti-spamming, in the same way that focusing
on Hawke's rise and fall could give readers a good insight into the
ways of the spammer.

Shiksaa was conflicted about being the center of the story, partly out
of modesty, and partly out of concern that the book would subject her
to more reprisals.  Still, she gave me hours of interviews. When I told
her I had decided to make her the book's heroine, she wasn't happy,
and she told her colleagues not to talk with me. But she continued
telling me about her story. 

When O'Reilly put a sample of Spam Kings online last fall, she
complained loudly in the Nanae newsgroup about how she was depicted.
But after the book came out and she read the copy I sent her, Shiksaa
thanked me and asked for two additional copies so she could give them
to relatives. So, in the end, I hope things have turned out OK. 
  

    
(NOTE: If you're reading this from offsite, you can send your comments or
questions to <inkwell-hosts@well.com> to have them added to the
conversation.)
  

    
I'm curious.  Do spammers typically break the law (apart from anti-spam
legislation)?

I saw a story yesterday about Earthlink winning a "substantial" settlement
from the "Alabama Spammers", who were commiting identity theft in order to
get Earthlink accounts to spam with.  Is this typical?
  

    
>Do spammers typically break the law (apart from anti-spam
>legislation)?

John, if you mean, do spammers breaks laws in addition to anti-spam
laws, the answer is often yes. A number of spammers have been tripped
up for crimes including fraud, identity theft, etc. (Howard Carmack,
the so-called "Buffalo Spammer" is one example.)

Jason Vale, one of the main figures in Spam Kings, ignored a spam
lawsuit from AOL but was finally put out of business (and into jail)
for violating a consent agreement with the Food and Drug
Administration. Vale had been sending spams for apricot seeds (a.k.a.
Laetrile) as a cancer cure. (He believed the seeds had cured his own
cancer, and, freed of a big tumor, went on to become a champion arm
wrestler.) Vale is now serving a five-year jail term for contempt of
court.
  

    
Brian, this was a great book. In fact, I'm at a little bit of a
disadvantage here because I got the book a month ago, and read it
within a few days, because i could not put it down, so it's not as
fresh in my mind as I would like.

I say this with some chagrin. I have for years been thinking and
talking about doing a book, or at least a long magazine story, like
this. But I just never really got serious about it. 

I interviewed Shiksaa briefly for a story I did last year, and she was
*way* skittish about talking to me at all. Said she'd been burned by
journalists in the past. So, good going, getting her to open up like
she did.

I have lots of questions, but I'll start with this: You handled tone
really well here -- straight narrative without a lot of commentary on
your part. You seemed to realize that showing trumped telling here even
moreso than in most stories. You didn't need to characterize
scumbaggery as scumbaggery -- the Spam Kings did it themselves, through
their actions. So, on those rare occassions where you *did* drop in a
little commentary, it really worked. 

But the book never really got around to directly confronting these
people on their lack of scruples. Did they feel bad about what they
did? How did they feel about the fact that everybody hates their guts?
How do they feel about the fact that they annoy people for a living?
Did they even think about this? And what were the root causes of this
particular pathology? What psychological dysfunctions do spammers
share, if any? 

You do address this stuff, but only in kind of a glancing way. I would
say it's one of the few flaws (if it can even be called that) in the
book -- it was never really explicated. Was this something you gave a
lot of thought to? Was it a conscious choice.

Thanks for coming here to do this, by the way.
  

    
Dan, thank you for reading Spam Kings. I'm honored to get praise from
such an accomplished writer. 

>But the book never really got around to directly confronting these
>people on their lack of scruples.

That is a very interesting observation. I admit that I never directly
asked any of the spammers whether they felt remorse about being
spammers! 

I'm no shrink, but the spammers I profiled do tend to exhibit some
interesting coping behaviors, if not outright pathology.

Consider, for example, their rejection of the label "spammer." They
tend to prefer the term "bulker" instead. Scott Richter even goes so
far as to call himself a "high-volume e-mail deployer." 

Spammers also tend to blame their problems on "antis" -- as if spam
was only a problem for a strident minority. 

Ultimately, the allure of money seems to steel these people against
criticism. As Doctor Fatburn tells Shiksaa at one point, "I make more
money in one day than you'll make in your entire pathetic life." (Or
something along those lines.)
  

    
Mr. Richter's insistence on distinguishing himself from the other
spammers did strike me as funny.  Is there a pecking order among
spammers? Do they have a sense of "well, I send bulk e-mail, but at
least I don't X"?
  

    
Richter insists that the recipients of his emails "opted in" to
receive them, and that his company is dutiful about removing anybody
who wants off his lists. Richter also buys or rents network addresses
for sending his email and hosting his web sites. 

As such, Richter obviously is in a different league than a spammer who
simply harvests addresses off web pages, sends his spam through hacked
third-party computers, and doesn't honor unsubscribe requests. (As I
describe in Spam Kings, Davis Hawke bought a lot of his addresses from
an AOL employee who stole AOL's member database and sold it to
spammers, and he sent most of his spam through "proxy" computers in
order to hide his tracks.)

But the lowest of the low would be the "phishing" spammers who
broadcast those bogus emails that look like they're from banks and ask
recipients to confirm their account information. 
  

    
My question is more towards "do the spammers themselves make a
distinction?" Do they consider phishing the lowest of low? 

That leads to another question I have: How much sharing and/or copying
of technique goes on between spammers? In the book, Davis Hawke copies
and modifies the text of some spams he receives himself.  Does that go
on a lot? Is there any deliberate sharing, a sort of professional
development organization?  Maybe I'm imagining too much organization on
their part :-)

For example, when I get fake rolex ads for a couple of weeks, is that
one spammer, or is it several spammers trying the same technique?
  

    
>My question is more towards "do the spammers themselves make a
>distinction?" Do they consider phishing the lowest of low? 

David, sorry. The "opt-in" spammers definitely see themselves as
distinct. The rest look down on the phishing scammers ... but they also
may depend on them for a steady supply of proxies. Many of the people
running the phishing schemes also control the big "botnets" of hacked
computers that are used today to send about 60% of all spam.

To most spammers, the most important distinction is between who's
making lots of money and who isn't.

>Is there any deliberate sharing, a sort of professional development
>organization? 

Definitely. Spammers congregate in online spamming forums, where they
do business deals and trade information. Some also participate in
private mailing lists set up by vendors of spam software. In recent
weeks, two popular forums, SpecialHam.com and SpamForum.biz, have been
booted by their web hosting companies. But they'll no doubt resurface
again soon. Archive.org has a copy of the front page of SpecialHam.com
here:

http://web.archive.org/web/20031002015930/www.specialham.com/specialham/

>when I get fake rolex ads for a couple of weeks, is that one spammer,

>or is it several spammers trying the same technique?

Hard to say without seeing the particular spams. Many spammers hire
affiliates and pay them a commission to send e-mails. The "sponsors"
typically provide ad copy to affiliates. So you may get several spams
for the same replica watch site, each from a different affiliate. 
  

    
Of course, "opt-in" spammers are lying that most of the people they
spam have opted in to anything. They may be lying to themselves, as I
think Richter may be, but they are lying nonetheless.
  

    
I suspect that if you're in the business at all, and you think that
it's about anything besides money by any means possible, then you're
lying to yourself at some level :-)

Brian, that link to the archive of the specialham site reminds me that
I wanted to talk a bit about the process of writing this book.  I
haven't seen one before where so much of the research was from archived
web sites, Usenet posts, and so forth.  It was fascinating to be able
to go to google groups and read some of the threads in nanae myself:
The actual chat transcripts that were posted, Richter's blustering
posts... 

Do you think using so many Usenet postings as source material affected
how you wrote the book?  Was it a good thing?
  

    
>I wanted to talk a bit about the process of writing this book.  I
>haven't seen one before where so much of the research was from
>archived web sites, Usenet posts, and so forth. 

David, yeah, I'm probably one of the first authors to mention Google
Groups and Archive.org in her or her acknowledgments. :)

Most spammers (and anti-spammers too) don't want to draw any attention
to themselves. So researching Spam Kings was a challenge. Hawke was
particularly paranoid. Here's a guy who constantly uses aliases,
ever-changing phone numbers, post-office boxes, email accounts. What
possible benefit would any spammer gain from being in my book? I
eventually wore Hawke down after nearly a year of following him around.
(At one point, he wanted me to promise I'd put his photo on the
cover.)

I reconstructed a lot of the stories in Spam Kings from the usual
source material most investigative journalists rely on: court records,
interviews, business documents, articles, etc. But I did end up relying
heavily on Internet sources such as newsgroups, archived web sites,
domain registrations, and chat logs. Much of the story also came from
the spams themselves, copies of which had been stored in newsgroups and
on the web. 

>Do you think using so many Usenet postings as source material
>affected how you wrote the book?  Was it a good thing?

It made me conscious of the fact that, to some extent, I was writing a
cultural history, and that others could easily go to Google and
independently verify my description of certain events. I actually liked
being in that situation. It's liberating to have publicly accessible
documentation to back up your story.

But I made a decision early on not to reproduce chat logs and
newsgroup conversations in their original format. I didn't want to
foreground the medium from which I snagged the material. Instead,
whenever possible, I tried to reformat conversations as conventional
narrative dialogue.  
  

    
>"opt-in" spammers are lying that most of the people they spam have
>opted in to anything.

Dan, it's true that many people probably don't realize that they have
opted in to spam lists (particularly when the spammers don't use a
"double opt-in" system, in which recipients have to confirm their
interest.) 

But in looking over the numerous pages of exhibits provided in NY vs
Richter et al., I was amazed at the ingenious ways that the marketers
were duping people to opt in. I mean, who could resist a free copy of
the "Girls Gone Wild" DVD? (Never mind the fine print that says that,
in accepting the offer, you are giving marketers permission to bombard
your inbox.) 
  

    
I've noticed a definite generational difference among people I know. 
There's a growing number of younger people who think that getting a
free ipod (or even a copy of Girls Gone Wild) is a perfectly acceptable
trade for some extra spam.  I'm not sure why that is -- possibly
because they treat e-mail addresses as disposable?

That does bring up another (devil's advocate) question that's central
to any debate about spam: Is it really that big of a deal?  Assuming
you're not paying by the minute, and assuming you're not getting
hundreds of spams a day, what's the big deal about deleting 20-30
messages?

Or, asked in a less provocative way, what is there that's so offensive
about spam that would cause people to spend so much time tracking down
spammers?  Is it just another hobby?
  

    
Actually, given the effacacy of my current spam filter, a free iPod might be
worth it.....
  

    
I've concluded that -- beyond the simple annoyance factor, which is
the main thing -- there is also this: spammers are scumbags and
hucksters. They sell sleazy, scummy products in a sleazy, scummy way.
And I simply don't want them contacting me or having anything to do
with me. *Especially* on my computer, which I consider sacred, private
ground: my domain. 

But beyond that, I get about 300 spams a day at this point. I have a
two-belts-and-suspenders set of filters that means that now, only 3 or
4 end up making it all the way to my inbox. But I still have to scroll
through all the crap to make sure I didn't miss anything legit. Why
should vermin like Richter get even a *nanosecond* of my time?

Also, don't forget the costs to ISPs and private networks -- borne by
businesses and private net users alike. It's just astronomical.
  

    
Brian, I did a quick scan on some of the reax to the book in Nanae.
Wow, some people are stupid. Among other idiocies, several people are
saying that shiksaa should sue you because you used her in the book
without paying her. Like, several people.

What's the reaction been like from you perspective, both from
spammers, antis, and everyone else, for that matter?