Spam Kings (27 page)
When Scott Richter tried to reach Dustin Parker on his company cell phone one Saturday
in early November 2003, the sultry voice of a sex-chat-service operator answered instead.
Assuming he had misdialed the number, Richter hung up and again tried phoning Parker, the
head of information technology at OptInRealBig
. But the call went through to the sex line the second time as well.
[
18
]
This was not a good thing. Richter and other company personnel routinely gave out
Parker's number to major customers who needed after-hours technical support or other
customer service. Richter's first impulse was to blame anti-spammers. The previous spring,
someone had apparently hacked into OptinRealBig's telephone network switch. The hackers
enabled a feature that caused the twenty-four phones in the building to begin ringing all at
once. Employees had to unplug their telephones for several hours while the company tried to
solve the problem.
But anti-spammers weren't responsible for the latest telephone prank. When Richter
finally reached Parker on his private line, the 18-year-old admitted he had set up his
company cell phone to forward to the sex line. Parker said he did it as a joke. But Richter
soon realized that Parker had a different goal in mind. He wanted customers to think
OptInRealBig was going out of business.
After picking up his last paycheck on November 7, Parker had joined a mutiny by six key
OptInRealBig employees. Parker, the kid who had been Richter's right hand from the start,
and into whose PayPal account the two had dumped their first Internet sales, had walked off
the job and apparently taken confidential company information with him. Parker, whose name
was listed on many of OptInRealBig's domains and who had even lived in Richter's house at
one point, was sabotaging the company he helped build. Parker, the mini-Richterâjust
five-eight, but checking in at around 200 poundsâhad double-crossed his mentor in order to
work for a new boss, OptInRealBig's former sales manager, Jeff Perreault.
Perreault, 30, had been with Richter a long time too. Richter had listed him as the
company's manager when they incorporated OptInRealBig.com LLC shortly after the 9/11
American flag spams. He even made Perreault a 10-percent owner of the firm. But after
several months of missing sales targets, Perreault was fired by Richter in October 2003.
Richter offered to keep him on as an independent contractor and gave him $10,000 in
severance pay when Perreault accepted the deal in writing a week later.
Richter had no idea Perreault would so blatantly breach the contract. The former sales
manager, along with Parker and the four other OptInRealBig employees, had quietly set up
Avalanche Denver Internet Marketing, their own spamming operation, soon after leaving
Richter's firm. Perreault promised that, unlike OptInRealBig, the new company would
distribute its winnings more equitably. But first, they'd need some customers. Working from
an office Perreault had set up in Denver, the crew was on the phones to prospects, most of
them gleaned from stolen copies of OptInRealBig's customer list. They told prospects that
Richter's firm couldn't function without Parker and was likely going under. Some
OptInRealBig customers decided to make the switch.
[
19
]
On their way out the door of OptInRealBig, Parker and his colleagues had grabbed several
goodies besides the customer list, including a couple of computer hard drives, the company's
financial records, and some proprietary software, including OptInRealBig's program for
automatically removing spam recipients from mailing lists, as well as the complete database
of email addresses generated by the program.
Richter also had reason to believe that before Parker left the company, he had set up
OptInRealBig's mail server to intercept email addressed to Richter or his father, the
corporate counsel. Records showed that Parker had also tapped into other email accounts to
access confidential information. Then there was the report from Hoffmann that Parker had
sent copies of his IM logs to Shiksaa, in a clear breach of his nondisclosure agreement.
Richter knew there was no telling what kind of information Parker was feeding the
anti-spammers. (In fact, Parker had also revealed to Shiksaa he was the one who had
"photoshopped" the images of her condo after Richter had given him the photos.)
[
20
]
Richter contacted his attorney in Denver and began working up a lawsuit against Parker,
Perreault, and the others. The plan was to hit them with breach of contract, business
interference, trespass to chattels, and a slew of other charges. Richter wanted a court to
issue a preliminary injunction that would stop the ex-employees from further sabotaging
OptInRealBig's business.
But at the beginning of December, Richter suddenly found himself on the receiving end of
a lawsuit. Officials from the New York Attorney General's office wanted to talk with him
about several batches of spam that had been sent out from May through July of 2003 using
proxies and fake headers. New York State prosecutors said they had traced the sites
advertised in the spams to a New York company called Synergy6, which said it had
subcontracted the emailing to Richter.
Richter knew New York's Attorney General Eliot Spitzer was on the warpath against
spammers. In February of that year, Spitzer had pulled off a successful lawsuit against
another self-proclaimed "opt-in" email-marketing company. A federal court judge ruled that
Monsterhut, a Niagara Falls, New Yorkâbased firm, was deceptively representing its service
as "permission based" or "opt-in," when in fact Monsterhut's mailing lists contained
millions of email addresses of consumers who had never asked to receive ads. The court
permanently banned Monsterhut from engaging in such acts in the future.
In a conference call with Spitzer's office, with Richter's dad on the line in San Diego,
Richter explained that OptInRealBig had never directly sent any messages for Synergy6 during
the period in question. All the email was the work of one of his affiliates, a Texas company
named Delta Seven. Richter explained that OptInRealBig had forwarded to Delta Seven the few
complaints his company had received about the messages. He provided investigators with
contact information for Delta Seven's owners, Paul Boes and Denny Cole, and hoped that would
be the end of his involvement in the matter.
But a week later, a certified letter arrived from New York. It announced that state
regulators had commenced litigation against Richter, "among others." The letter accused him
of a variety of deceptive business practices, including email header forgery, as well as
false advertising. A few days later, Richter got word that Microsoft was teaming up with New
York on a parallel lawsuit, on the grounds that its Hotmail service had received potentially
millions of the illegal spams.
The whole matter apparently grew out of a complaint filed by a Hotmail user in June
2003. After receiving several unsolicited emails for "free" offers from Synergy6, the
Washington resident had reported the spam to Microsoft, with carbon copies to numerous
agencies, including the Federal Bureau of Investigation, the Federal Trade Commission, and
even the International Criminal Police Organization, or Interpol.
Upon investigating the complaint, officials at Hotmail discovered that spam traps they
had set up received over 8,000 copies of the messages advertising Synergy6 web sites between
May and June of 2003. (The ads had been sent to unpublished addresses created by the service
to track spammers, especially those who claimed recipients had opted to receive the
messages.) The Synergy6 spams touted a variety of "free" gifts ranging from donuts and
sunglasses to electric toothbrushes and a pornographic video entitled
Girls Gone
Wild
.
In order to take advantage of the offers, consumers had to provide personal information
at the coregistration sites, including demographic data, and consent to receive future
mailings from Synergy6 or its partners. In most cases, consumers also had to make a purchase
at one of Synergy6's sites in order to qualify for the "free" gift. (The terms and
conditions of Synergy6's offer didn't sugarcoat the fact that consumers who registered would
have their information sold to "marketing partners." Yet Synergy6 said it was not
responsible for helping consumers get off the mailing lists of those third parties.)
After analyzing hundreds of spam samples, prosecutors determined that Delta Seven had
routed the messages through proxy computers all over the world in an effort to protect the
company's identity and avoid spam blacklists. Out of the hundreds of proxies used by Delta
Seven, scores were hacked or virus-infected computers operated by customers of Comcast and
other cable companies.
As Richter awaited the details of the New York and Microsoft lawsuits, he decided to
drop the hammer on Parker, Perreault, and the other defectors. On December 11, his attorney
filed a sweeping lawsuit in Denver district court, requesting not only injunctive relief
against the former employees but also punitive and compensatory damages.
Parker was badly shaken by the news. That day, he was pulled over by police a couple of
blocks from Denver's Pepsi Center sports arena and was charged with driving while his
ability was impaired.
[
21
]
Later, Parker contacted Shiksaa and pleaded with her to sign an affidavit saying
he had never given her any AIM logs.
After Shiksaa refused to lie for Parker, the two didn't chat again. But she was
surprised to get an instant message from Richter around noon on December 17. He
matter-of-factly informed her that the New York Attorney General and Microsoft were going to
announce a lawsuit against him the next day.
"Should be good news for you guys to cover, since you all love me so much," he
said.
When Shiksaa asked for details, Richter told her Paul Boes of Delta Seven was really the
target of the lawsuits. According to Richter, Boes was in trouble primarily for sending mail
through proxies. Richter's only involvement, as he explained it, was introducing Synergy6 to
Delta Seven.
"No idea why I'm part of it," said Richter, who claimed the lawsuit would actually end
up helping him. "More press to show I did nothing wrong and don't use proxies," he
said.
Shiksaa told Richter to keep her apprised of the details and then said goodbye. But as
she thought over the matter later that afternoon, Shiksaa began to wonder whether Richter's
indifference to the lawsuit was justified. She knew that Boes and Richter had been business
associates for years. Boes had sold his company, Wholesalebandwidth (WSB), to Richter that
fall but had stayed on as a WSB customer. Shiksaa did a quick Usenet search and found a
handful of reports from Internet users who had received spam from WSB throughout the summer.
All of the reported spams contained bogus headers meant to look as if the messages
originated from Hotmail or AOL. Such header forgery was obviously Boes's modus
operandi.
Shiksaa confronted Richter over AIM. "Scott, you knew Boes forges headers," she
said.
[
22
]
Richter replied that he never really looked closely at Boes's messages. In any case, the
spammer hadn't been using Richter's network since May, Richter claimed.
"Your abuse desk has nothing on him?" asked Shiksaa.
Richter said he hadn't received any complaints about Boes. "I do not allow anyone doing
illegal things," he added.
Shiksaa cut and pasted some of the WSB spams she had located.
"You said he never forged while he was with you," she told Richter. "I say you either
are lying, or you haven't bothered to read your abuse mailbox."
"The last thing in the world I need to do is have someone doing something wrong on net
space I'm on, as I know I'll get the blame for it," he said.
Shiksaa pasted a few more examples of WSB spam with forged headers. "Why do you continue
to deny it?" she asked.
"I do not run the abuse department," he replied.
"Then they knew it, and it went on for months."
Richter paused a moment. "Susan, let me ask you this, and answer honestly..."
"I'm always honest."
"What incentive do I have to throw anyone off? Spamhaus and Spews would never de-list
me, right? As long as someone is not breaking a law, what is the point to get rid of
business?" he asked.
Shiksaa couldn't believe Richter's swift about-face. "You are responsible to know what
goes on in your company," she said.
"I know how to promote and run a business, not a tech department."
"And what's Karen's excuse?" asked Shiksaa, referring to WSB's abuse department head,
Karen Hoffmann. "She can read a header can she not? She was your employee. You are
responsible."
Before Richter could reply, Shiksaa came right back at him. "You know what? Just to
repay you for publishing my father's information out of spite, I'm going to make sure the
attorney general's office knows where to find proof of forgeries," she said.
"Susan, I never forged, and I had nothing to do with your dad."
"You published my father's personal information out of malice. Now I'm going to repay
that favor, Scott. Don't contact me again. And I hope you get sued into oblivion."
"Whatever," was Richter's only response.
As Richter predicted, New York Attorney General Eliot Spitzer and Microsoft General
Counsel Brad Smith held a joint press conference the next day in New York to announce their
lawsuits. Spitzer began by describing the three respondents, referring to Richter as the
third-largest spammer in the world. Then Spitzer zeroed in on the subject of header forgery.
He noted that Microsoft's spam traps had attracted over 8,000 spams from Scott Richter in a
one-month period. All of the messages, according to Spitzer, contained bogus headers
designed to evade the spam filters used by ISPs and computer end users.
