Spam Kings (26 page)

All three sites had published articles about the time-travel spammer's unmasking. But it
wasn't certain that Todino was responsible for the Joe-job. The domain advertised in the
spams, QuickEasySolution.com, listed a fictitious Woburn, Massachusetts, street address—the
same address Todino had given in previous domain registrations. However, it was possible
that Todino himself was the victim of an elaborate Joe-job.

But at least one of the attack victims was confident Todino was to blame. In a message
on his site, Sosik-Hamor said he had previously been a fan of the strange messages about
time travel. "I've thought that the author was pretty cool. A few fries short of a Happy
Meal, but cool...Now I feel almost betrayed by Robert," he wrote.

The next day, Todino broke his silence. He changed the home page of
QuickEasySolution.com, replacing the ad for "Email Filter" with a new page. On it, Todino
denied being responsible for the Joe-job and apologized to the victims. "There are those
wishing to do me greater harm then you can possibly comprehend," he said.

Todino eventually took down the page and went back to hawking anti-spam software and
government grants. But he stopped sending time-travel spams.

Around Labor Day 2003, Shiksaa's outrage at The Gang That Couldn't Shoot Straight
(Marin, Richter, Waggoner, and company) finally began to fade. She would never forgive them
for publishing her and her dad's personal information on the Internet. But it appeared that
the spammers' litigation against her and the rest of the Nanae Nine had imploded.

On September 3, the mysterious EMarketersAmerica.org (EMA) voluntarily withdrew its
lawsuit after realizing it was about to backfire horribly. The EMA had hoped to sue
anti-spammers into unmasking the operators of Spews. But it became clear that the lawsuit
would expose EMA members' own operations to the same risk. Pete Wellborn, the attorney
representing the defendants, had been crowing that he would use the legal discovery process
to thoroughly dissect the companies responsible for the litigation.

The day after Wellborn filed a withering 110-page motion to dismiss, EMA attorney Mark
Felstein waved his white flag. It was the second humiliation for Felstein in recent months.
In June, the New York Bar Association had denied the Florida lawyer's petition for
admittance, citing Felstein's history of substance abuse and criminal record. "We are not
satisfied that petitioner presently possesses the character and general fitness requisite
for an attorney and counselor-at-law," wrote the state's Supreme Court panel.
^[
15
]

But Wellborn and his clients weren't going to be content with a Pyrrhic victory. They
wanted to send a clear message to spammers who launch legal attacks: don't start what you
can't finish. Wellborn tried to persuade the court to refuse Felstein's withdrawal and
instead decide the suit on its merits. Wellborn argued that federal law prohibited a
plaintiff from unilaterally withdrawing a lawsuit once the defendant has answered the
charges.

Meanwhile, Steve Linford announced on Nanae that the defendants wanted Felstein to pay
their legal fees. "We're going after Felstein personally for every penny. He's whining he's
broke, but that's not going to wash. He can sell his house," wrote Linford, who then posted
a copy of the 1998 sales record for Felstein's condominium, which anti-spammers had
apparently located in an online database.

Shiksaa's relatively ebullient mood darkened a few weeks later. The October 2003 issue
of Conde Nast's magazine for men,
Details
, published its annual list of
the ten most influential and powerful men under thirty-eight. To the dismay of
anti-spammers, OptInRealBig
.com CEO Scott Richter was number nine on the list, which also included rapper
Eminem and actor Ben Affleck.

"Ninth largest spamming scumbag, maybe," wrote Shiksaa in a Nanae discussion of the
Details
list. When someone observed that Richter seemed to be adept
at generating publicity, she dismissed the idea. "Most psychopaths are good at
self-promotion. If you don't believe that, just Google the name of a certain Florida
lawyer," she said. Taking some of the sting away for Shiksaa and the others was a quote
about Richter from Linford that made it into the
Details
article: "The
only power he has is the power to annoy 100 million people."

Then more bad news for the Nanae Nine arrived. In October, Florida district court judge
Donald Middlebrooks granted Felstein's motion to dismiss.
^[
16
]
The EMA case was closed.

Stuck with thousands of dollars in legal bills and still smarting from Richter's
adulation in the mainstream media, Shiksaa and her codefendants got an even more stunning
piece of news in late November.

According to a new entry in the Spamhaus Rokso record for Scott Richter, three "former
spamfighters" had been discovered on Richter's payroll: former MAPS employees Kelly Molloy
(Thompson) and Pete Popovich, as well as Ohio anti-spammer Karen Hoffmann. The Rokso entry,
ROK2888, stated that the three were employed by Richter to handle network abuse complaints
and to perform "listwashing"—the task of removing angry spam recipients from
OptInRealBig.com's mailing lists.

The Rokso entry said Molloy and Popovich had been hired by Richter in January 2003 as
part of his "continuing efforts to appear legitimate," which represented "a depressing
reversal of ethics" according to the anti-spammers.

"Although their employment by Richter was initially presented as salutory [sic], in that
their work would eventually clean up Richter's operation, it has long since become clear
that they are complicit in his activities," stated ROK2888. The entry added that Karen
Hoffman, "turned away in her pursuit of spammer Thomas Cowles," had also joined Richter's
company in an "abuse position." A footnote on the page stated, "in Richter's lexicon, 'abuse
personnel' denotes not persons who counteract abuse but those who facilitate it."

Although the author of the Rokso entry was never revealed, news of its publication was
first announced on Nanae by Adam Brower, who had recently been added to the Spamhaus team.
The announcement set off a flurry of discussion, generating over 400 responses. Some people
accused the former anti-spammers of being traitors. One person said Richter's abuse
personnel were just as culpable as getaway drivers in a bank robbery. But others rose to
defend Molloy and Popovich, and supported their efforts to clean up Richter's operation from
the inside. They said the Rokso record was unfairly vindictive and undermined the register's
credibility.

A few hours later, ROK2888 was pulled from the Spamhaus site. In a note on Nanae,
Linford explained that the record would be placed back online after Molloy and Popovich were
removed. Karen Hoffmann, on the other hand, would remain. "The info on our internal list,"
explained Linford, "says Karen Hoffman is fully and knowingly involved in Richter's spam
operations."

The Spamhaus team learned that Hoffmann had been consulting to Richter since at least
early 2003 and had apparently taken great pains to conceal the fact. When spam recipients
emailed OptInRealBig.com to complain, she used a number of pseudonyms in her replies,
including the name "Karen Hughes." Hoffmann had also used the name Hughes, which wasn't her
maiden name, to register for the annual meeting of a technical association called the
American Registry for Internet Numbers (ARIN). Hoffmann traveled to the Chicago meeting in
October with Richter's computer whiz kid and head of information technology, Dustin Parker,
and had listed WholesaleBandwith, Inc. as her company's name. (Richter had recently acquired
WholesaleBandwith from a Rokso spammer in Texas named Paul Boes. The company had been booted
off over a half-dozen Internet service providers since 2002.)

When the information about her work for Richter finally became public, Hoffmann didn't
deny it. She waded into the turbulent discussion on Nanae with a note stating that she
wouldn't discuss the details of her employment. (Richter made it a point to get all
employees to sign a nondisclosure agreement upon their hiring.) But she defended Richter's
practices, noting that several large Internet service providers had "white-listed" him and
were allowing his messages to reach their subscribers.

"I've always believed we need a middle ground. There's got to be a compromise. Give them
a set of rules to play by. Make sure they play by the rules. Don't want their email at all?
Feel free to block them. They're not going away," she wrote.

Hoffmann pointed out that some anti-spammers had known of her affiliation with Richter
long ago. Indeed, she had hinted at her new employment in a May 2003 statement at her
personal web site, ToledoCyberCafe.com. In the update to her chronicle of tracking Empire
Towers spammer Tom Cowles, Hoffmann revealed she had started to take a broader view about
the best way to fight spam.

"I'm working behind the scenes with marketers to help them improve their practices. I'm
working with consumers and corporations on utilizing technology to stop the spam from
hitting their inboxes...I feel it is in everyone's best interests to work with marketers,
consumers, ISPs, and lawmakers alike to keep email a valuable communication tool," she
wrote.

But Shiksaa could barely contain her disgust at learning of Hoffmann's association with
Richter. When an anonymous person (who later turned out to be a Richter employee) posted a
note to Nanae defending Hoffmann and pointing out her work to stop Tom Cowles, Shiksaa
dismissed her former friend's contributions to spam fighting.

"Following Cowles around with a camera and publishing other people's research on her web
page didn't stop Cowles, nor did it stop any spam. The only thing she is doing to stop spam
is removing spam victims who complain from Richter's spam lists...and the whole while
passing herself off in this newsgroup as a person who didn't like spam," wrote
Shiksaa.

It was Hoffmann's duplicity that bothered Shiksaa the most. Molloy and Popovich didn't
announce their Richter affiliation with a bullhorn either. But at least they didn't try to
hide it or resort to using aliases in their work for the spammer. (Molloy and Popovich would
resign their posts with Richter soon after the Rosko incident.) Nanae regulars never take
kindly to "sock puppets"—pseudonymous participants who jump into the newsgroup to defend
spammers. But Shiksaa was especially astonished to learn that several Nanae postings by a
person calling herself Natasha Dorenkov were actually the work of Hoffmann.

Identifying herself as an abuse coordinator for the MyEmailWizard bulk emailing service,
Dorenkov had posted a note to Nanae that April. She requested that Spews reconsider her
company's place on the blacklist. When an anti-spammer asked whether her firm had any
affiliation with Scott Richter, Dorenkov replied, "Without checking first with our legal
department, I think I can safely say that Mr. Richter is an ex-list owner on our system."
Then, after being asked whether that was her real name, she responded, "Dorenkov is my
married name, although I am no longer married. My given name is Nataliya Byakov. I've always
gone by Natasha."

It was all fabrication. In fact, Natasha Dorenkov was an alias Hoffmann had been using
to shield herself while handling abuse complaints for Richter's various properties
(MyEmailWizard being one of them). Hoffmann wasn't proud of her dissembling on Nanae. But
she was quite satisfied with her achievements in Natasha's name. To spam victims who emailed
Richter's companies asking to get off mailing lists, Natasha was something of a heroine.
Many average Internet users had been conditioned not to trust opt-out instructions or
communications with "abuse" personnel at spam firms. But dealing with Natasha was different.
Hoffmann, as Natasha, was always quick to deal with spam complaints and treated spam victims
with sympathy.

Yet after Hoffmann was added to Rokso, and Shiksaa confronted her about using the alias
Natasha, Hoffmann at first denied it. That proved to be a mistake on many levels. As proof
that Hoffmann had been hiding behind the pseudonym, Shiksaa produced a snippet of an AIM
conversation between Hoffmann and another Internet user, whose screen name Shiksaa had
redacted. In the brief exchange, "Karen Hughes" jokingly told the unidentified person that
she was "Natasha."

When she saw the evidence Shiksaa posted on Nanae, Hoffmann was mortified, and not just
because she realized it was incontrovertible. Hoffman recognized the conversation; she had
been chatting with Dustin Parker at the time. Clearly, Parker had betrayed Hoffmann and had
given Shiksaa a copy of the log file of their chat. Hoffmann wondered what else Parker had
shared with Shiksaa.

By December 2003, Hoffmann had her own entry on the Spews blacklist. Spews listing S2938
stated that she was "an anti-spammer gone bad" and called her "spammer Scott Richter's
list-washer." Besides ListSupport.net, Spews listing S2938 also included the address of her
personal site, ToledoCyberCafe.com. Hoffman's Spews entry even contained the IP address of
her cable modem service from Buckeye Express.

Hoffmann thought it petty of Spews to black-hole ToledoCyberCafe.com. But what bothered
her most was the mystery of how Spews had gotten the cable modem's IP address. She had been
very careful not to disclose it in the headers of her newsgroup and email postings and
always used her AOL account to post messages. And, as far as she knew, AOL Instant Messenger
wouldn't reveal her cable modem's IP address to others.

Hoffmann ran a search for the IP address in all of the text files on her computer. The
only place it showed up was in an AIM chat with Parker, in which she had intentionally sent
him the IP number. Obviously, that chat log file was among those Parker had given to
Shiksaa. But that still left the question of how Spews had gotten her IP address. Somehow it
had gone from Shiksaa's hands to the blacklist operators.

As Hoffmann saw it, there were only two possibilities: either Shiksaa had given it to
someone connected to Spews, or Shiksaa herself was directly involved with the
blacklist.
^[
17
]