Rise and Fall of a Spam Crusader 

On May 3 of this year, in Northern California's U.S. District Court, a tiny Garberville company called ASIS Internet was awarded nearly $2.6 million in an anti-spam lawsuit. At the time, ASIS -- an acronym for Access Solutions Information Services -- had fewer than 1,000 customers, most of whom still accessed the Web through dial-up connections. The company had filed suit under the federal CAN-SPAM (Controlling the Assault of Non-Solicited Pornography And Marketing) Act of 2003, claiming that the defendant, an online marketer called Find a Quote, had sent its customers nearly 25,000 unsolicited e-mails over a period of 18 months. Ruling in ASIS's favor, Judge Elizabeth D. Laporte awarded the Garberville company $2,596,020 in damages -- nearly $650,000 for each of ASIS's four employees.

Technology websites and bloggers heralded the victory as a David-versus-Goliath-type success story. London's The Register, one of the world's largest online tech publications, called the judgment "a testament to the awesome power of CAN-SPAM."

But when the Journal reached ASIS President Nella White a few days later, she was hesitant to talk about the ruling. It wasn't exactly what it seemed, she said. "It makes a great headline, but the defendant can't be found." In fact, the primary defendant -- a man by the name of Edward Heckerson -- hadn't bothered to show up for the trial or to respond in any way to the numerous allegations against him. Last anyone heard, Heckerson was hiding somewhere in Panama. Because he didn't fight the allegations, the court granted a summary judgment that was impressive on paper but essentially worthless to the Garberville business, since the money couldn't be collected.

A similar thing had happened the previous year in a Florida case filed by ASIS against a spammer called All In, LLC. There, too, the defendant was a no-show. At one point, according to ASIS's lawyers, the search for All In's president included a county sheriff's deputy, a federal marshal and a process server. He was never found, so the Florida court's judgment in favor of ASIS -- $294,000 in damages and more than $12,000 in attorneys' fees -- has also never been collected.

White didn't want to talk about any of this. She said she was involved in other litigation and would prefer to wait to discuss matters. Over the next few months, the Journal contacted White several times by e-mail; each time she responded that she wasn't yet ready to talk. When finally reached by phone two weeks ago, White was agitated and distraught. She said she'd been forced to abandon not only her battle against spammers but her entire business, and now she was afraid of losing her house. "I've been eating Xanax with cream and sugar for breakfast," she said.

Her distress, it turned out, stemmed from a ruling that came shortly after the $2.6 million victory. On May 19, a U.S. Magistrate judge ordered ASIS to pay more than $800,000 in attorneys' fees to a company called Azoogle.com, Inc. More than two years prior, ASIS had filed suit against Azoogle, among more than 20 other defendants, alleging violations of both the CAN-SPAM Act and the California Business and Professions Code. The suit backfired. In April 2008 the court granted summary judgment in favor of Azoogle. (The other defendants had either settled or been dropped from the suit.) ASIS appealed the decision to the Ninth Circuit Court of Appeals, which, in December 2009, upheld the ruling with a curt, two-page declaration. In awarding attorney fees to Azoogle, the U.S. District Court found that ASIS had "acted unreasonably," that its evidence against Azoogle was "extremely weak," and that in bringing the lawsuit, ASIS likely had ulterior motives. Turns out they'd developed a habit of filing such claims.

"Having initiated over 20 similar actions, and sued over 20 defendants in this action alone, an award of attorneys' fees here is necessary to deter ASIS and other plaintiffs hoping to profit under the CAN-SPAM Act," Judge Joseph Spero ruled. Most of the 20-plus cases referred to by Spero had been settled before going to trial. In the judge's eyes, ASIS -- or their lawyer, at least -- was little more than a serial litigant making a business of extortion.

This accusation was not a new one for ASIS's lead attorney, Eureka litigator Jason Singleton, a man whose name strikes fear in the hearts of small business owners throughout California. Since 1997, Singleton has filed more than 75 lawsuits alleging violations of the Americans with Disabilities Act (ADA). These include cases against the County of Humboldt, the Eureka Chamber of Commerce, Barnes' Family Drug, Open Door Community Health Centers and numerous local bars and restaurants. (His 2008 suit against Eureka's Arctic Circle prompted the owners to close shop, hence the boarded-up windows you'll see there to this day.) Singleton's methods -- which include filing multiple lawsuits on behalf of the same clients and often focusing on minor infractions of ADA law -- have earned him a reputation as a shakedown artist ("Access and Dollars," March 8, 2001; "Jason Singleton Strikes Again," May 8, 2008).

White says she knew nothing of Singleton's reputation when she hired him, nor does she care to read the stories now. From her perspective, Singleton and his colleague Richard Grabowski were simply helping her to fight what had become a plague of parasite e-mails costing her thousands of dollars and countless headaches. For a while it seemed like they were winning the battle. Now she's been deposed, subpoenaed and ordered to pay $800,000 that she doesn't have.

"I thought I was the Jeanne d'Arc of spam," she said. "But then she got assassinated, so what was I thinking?"

Nella White has lived in southern Humboldt for 40 years, and like many SoHum residents she tends toward life's musical and mystic elements. She was in a rock band when she was younger, playing bass guitar and "harmonizing on shoobie-doobies and doo-wops." She also plays piano, is learning the violin, and in recent years -- she's now a few weeks shy of her 69th birthday -- White has been studying Vedanta, a Hindu philosophical tradition dedicated to reaching a cosmic consciousness that cannot be conveyed by language (though Sanskrit comes closest).

White's husband, Rex, started ASIS Internet with a partner in 1995. When the partner left after less than a year, White, who'd been doing custom computer programming for local businesses, stepped into his place. (When her husband left the business three years ago, White took full ownership.) The Internet was a vastly different realm back then -- its landscape less populous and more technically imposing. Tech-savvy spammers, like outlaws in the Wild West, essentially had free rein because mail servers ran on a system called open relay, which allowed Internet users to send mail through any server on the ’Net. Spammers loved this setup because it allowed them to hide easily by routing their scurrilous mass e-mails through third-party servers.

Policing these Web abusers was largely left to the Internet service providers (ISPs), many of whom fought back by closing their mail servers to all but their own customers. This worked fine, so long as their customers never tried to send mail from a friend or relative's house. White remembers the headaches. "[Customers] would call my office and say, 'What's wrong with your mail service?'" The solution involved changing the IP (Internet protocol) address on the mail server, then changing it back once the customer got home. "This was a tremendous nuisance," White said. "It involved two tech support calls just because you went to visit Aunt Susie."

This pattern would repeat itself again and again over the years: ISPs continued to develop new, more sophisticated protection methods only to see spammers find cracks in the firewalls. Each time the system changed, ASIS had to walk its customers through the new protocols. "I would say a third of our support time is spent talking people through e-mail configurations that would not be necessary if it weren't for spam," White said, absently reverting to the present tense. Gradually, consumer attitudes also changed. As ISPs got better at filtering out junk e-mails, their customers' expectations grew. Before long, when spam landed in a customer's inbox, she'd get angry at her ISP for not blocking it, rather than cursing the spammer.

The scale of this technological cat-and-mouse game is staggering. Of the 220 billion e-mails sent worldwide each day, as many as 90 percent are spam, according to the Messaging Anti-Abuse Working Group. Last year, spam cost businesses and consumers more than $130 billion through anti-spam technology, lost productivity and wasted storage. Small, remote ISPs like ASIS are not immune to this scourge. By the middle of the last decade, ASIS was receiving approximately 200,000 spam e-mails per day and spending $3,000 a month to fight them through contracts with filtering companies like Postini (now owned by Google) and time spent on customer support.

"The CAN-SPAM Act was passed, and I saw it as a way to recover some of this money," White said. In 2005, she retained the services of the Singleton Law Group, which had recently made major financial investments to fight just this type of case. "We were the leaders in the field, for sure," Singleton said in a phone interview two weeks ago. "I don't want to toot my own horn, but we had a full-time IT guy, a four-terabyte server, custom software to search through the database -- there was a huge investment on our part. I mean hundreds of thousands of dollars."

Over the next five years Singleton and ASIS filed a steady stream of lawsuits against a variety of alleged spammers. As with the targets of Singleton's ADA suits, plaintiffs often chose to settle confidentially out of court because, guilty or not, it's usually cheaper than going to trial. White estimates that during this period she netted $40,000-$50,000 per year from settlement revenues. (She wouldn't say how much she paid Singleton.) By her calculations, these payoffs still didn't make up for what she'd spent fighting spam over the previous decade. In fact, White viewed herself as an activist fighting for the greater good. And with spammers showing no signs of retreat, the battle had no end in sight. Until Azoogle.

"This one case that backfired -- this is the only case where the judge wasn't sympathetic to our point of view," White said.

Spammers are cagey. The good ones, anyway, the ones who get away with it. And over the years it has become increasingly difficult to define just who's a spammer and who's not. Here's one common system: Business interests, legitimate and otherwise, are constantly looking for potential customers, or "leads," as they're often called in sales. Rather than seek these customers directly, companies often employ "lead vendors" who offer e-mail addresses that have been collected by marketing specialists. Azoogle is such a specialist. These marketing specialists, in turn, contract with "affiliates" who resort to their own means of gathering leads. These affiliates sometimes hire affiliates of their own. So while companies like Azoogle may have anti-spam policies in place -- as Azoogle, in fact, does -- it becomes virtually impossible to guarantee that none of the leads they're selling came from some ne'er-do-well spammer who hacked his way into a listserv. Critics of this system point out that such diffuse responsibility works to the advantage of everyone involved -- except the consumer.

Cut to 2005, the height of the housing boom. No business interests in the world were more desperate for leads than mortgage companies, with new ones popping up daily and offering no-documentation home loans to virtually anyone they could find, however they could find them. ASIS's case against Azoogle, which was initiated on Dec. 12, 2005, as "ASIS Internet Services v. Optin Global, Inc., et al.," alleged that each of the 20-odd plaintiffs had either sent, commissioned or facilitated misleading, unsolicited mortgage-related e-mails to ASIS customer addresses, many of which hadn't been active for a year or more. Gradually, through settlements and discovery, all the plaintiffs except Azoogle were eliminated. Azoogle wanted to fight the charges.

Venkat Balasubramani, a Seattle-based lawyer who specializes in commercial and intellectual property disputes as well as media and technology, frequently blogs about CAN-SPAM litigation and has chronicled the legal ups and downs of ASIS. Speaking generally, Balasubramani said that small ISPs like ASIS tend to go after companies that are easy to find but not necessarily the true culprits. "If I'm a smaller ISP and I can easily trace somebody who's sending an e-mail, those aren't the real troublemakers," he said. "It's [more likely] somebody in a foreign country, using sophisticated tools to mask their identity." The obvious targets are also the ones with deep pockets, he said.

A key turning point in CAN-SPAM litigation came with a 2007 decision in the case of Gordon v. Virtumundo. Ruling in favor of the defendant (an online marketing firm), a Seattle district court judge found that plaintiff James Gordon's so-called Internet business was little more than a shell used for filing CAN-SPAM lawsuits. In a landmark ruling, the court awarded Virtumundo $111,000 in attorneys' fees, slamming Gordon's operation as a "litigation factory" and calling his lawsuit "ill-motivated, unreasonable and frivolous." After the trial, according to news reports, Virtumundo sent a collections lawyer to Gordon's house with a moving van and a sheriff. The lawyer offered to go away if Gordon would agree to drop his appeal, and when Gordon refused, the collections agency proceeded to clear out the contents of his house. (He probably should have acquiesced; the Ninth Circuit Court ultimately upheld the ruling.)

The Gordon case proved significant in ASIS v. Azoogle for two reasons -- first, judges thereafter were wary of frequent CAN-SPAM litigants, especially small ISPs; and second, the case established specific guidelines to determine liability. In order for a plaintiff to have standing to sue, the court said, they must show not only that the defendant was responsible for the spam in question but also that the spam caused some sort of measurable harm -- crashing their system, for example, or forcing the company to upgrade its filtering software.

In the case versus Azoogle, Judge Joseph Spero ruled that ASIS had met neither of those requirements. It hadn't suffered any measurable damage and it failed to establish a solid connection between the mortgage spam and Azoogle. "Rather," Spero ruled, "it is apparent that ASIS sued Azoogle based on little more than speculation that there might be a connection between those e-mails and Azoogle." The Ninth Circuit Court upheld the ruling on appeal with an unpublished disposition, and Spero ultimately granted Azoogle's counter-motion for sanctions against ASIS, ordering White to pay the company $806,978.84 in attorneys fees -- far more than she'd made in all her previous settlements combined.

Singleton said the ruling was monumentally misguided. "The CAN-SPAM Act is dead," he declared -- at least for ISPs, it is. Singleton believes the evidence threshold now required in such cases is virtually impossible to reach. "Out of 200,000 spam e-mails per day you're trying to show harm from, say, 3,800 e-mails received over a two-month period," he said. "There simply is no way to [do that]." Not surprisingly, Singleton and his colleague Richard Grabowski disagree with pretty much all of the court's findings in the case, but what's most galling, they said, is how the ruling effectively eliminated ISPs' ability to be bounty hunters, the role to which they were duly anointed by the CAN-SPAM Act.

Meanwhile, spam hasn't let up. "It's increasing anywhere from 100 to 300 percent a year," Grabowski said. "Most ISPs spend a quarter to a third of their entire revenues doing nothing but preventing spam and hackers. You don't see it anymore because they've gotten good at it. But I guarantee you that your e-mail account is receiving three or four hundred up to five or six thousand spam e-mail a day. ... And the cost is embedded in your bill."

But are small ISPs like ASIS really the best bounty hunters for modern spammers? Balasubramani doesn't think so. Large companies like Google and Microsoft regularly send out press releases announcing that they've shut down some major spammer. They can achieve that because they actually have the resources to locate and destroy these complex operations, Balasubramani said. "Larger ISPs have more sophisticated measurement systems, probably better experts and can just frankly put together a case that covers all the bases," he explained. Besides, he said, if a small ISP really has pure motives, it wouldn't look to litigation as a first option. "You never see somebody sending a letter saying, 'Here's the problem: We're getting these advertisements. Can you make them stop?' You get a letter saying, 'You owe $5 million," Balasubramani said. "I wonder how effective a simple letter would be."

After the Azoogle ruling, White sold her business' assets cheap to two of her employees, who have continued to operate as ASIS, though technically it's a new entity (the acronym now stands for A Simple Internet Solution). The rapid change of tides has left White shell-shocked. "I was having panic attacks," she said. "It's probably not entirely rational, but when you're frightened your mind goes to a lot of strange places." When she's calm, White reasons that if she doesn't have the $800,000 then she doesn't have it. Simple as that. She just can't quite fathom how she ended up here. "I don't feel like I did anything wrong," she said. After all, spammers are the real bad guys: "I maintain that they're stealing resources, stealing server space, stealing bandwidth -- all of which is paid for by ISPs who have to pass it on to the customers."

True as this may be, it's past the time for arguments. White left town this week to continue her studies of Vedanta and Sanskrit, but she'll come back to her home in Garberville. Singleton's law practice continues, though he says his days of prosecuting CAN-SPAM cases are over. Spam, meanwhile, shows no signs of slowing. According to technology corporation Cisco Systems, Inc., the volume of spam worldwide is expected to be 30 to 40 percent higher than the 40 trillion sent last year.