It is difficult to level criticism at a Company such as Spamhaus. One that appears to stand for all that is good in the fight against spam. As the owner of a highly reputable email marketing software company and a true believer in eradicating spam, you might imagine I would be their greatest supporter. I was until a recent incident involving an agency supported by ION, and Spamhaus. The methods employed by Spamhaus on this occasion, combined with extremely poor communication from them, makes me now consider them less like a good cop, more like an untouchable dictator.
Several years ago we installed an email marketing solution for a very reputable agency, providing email marketing services to their clients. They have contracts in place insisting that their customers only use opt-in lists. On one occasion one of their customers sent an email to what they claimed was their opt-in email list. Due to a number of complaints and emails appearing in spam traps, Spamhaus correctly diagnosed spam emanating from the Agency network. They then listed the service.
This is a common practice. Once listed, any email shot broadcasting from that server more or less becomes useless. On this occasion however Spamhaus decided not to list the offending server. Instead they took a more radical step, deciding to list the Agency’s entire IP range. This effectively closed all email traffic to and from the agency. The agency host emails for around 400 corporate email accounts and perform email marketing for around 200 customers.
Spamhaus was contacted through their web forms. Their web site doesn’t list a phone number or postal address or any contact information. In reply, they claimed that they needed to be contacted by the “network owner” to release the ban. The Agency is listed with RIPE as the owners of their IP address and they certainly own their network. It emerged that Spamhaus had meant to say “upstream provider”. This confusion caused an unnecessary extra delay of two days
The Agency were unable to make direct contact with Spamhaus to explain their standpoint and Spamhaus appeared unwilling to listen. This situation forced the Agency to draw up ridiculous contingency plans in order to keep their business afloat. They constantly emailed Spamhaus via their web forms only to be greeted with the same automated response.
It was when they told their upstream provider that they may have to dismantle their network, give up their IP addresses and start again elsewhere that the provider decided to contact Spamhaus. The provider could hardly believe the massive reach of Spamhaus and the plight of the Agency. How could a simple addition to the Spamhaus list effectively put an email Agency out of business for almost 72 hours?
24 hours after being contacted by the upstream provider, and after 3 days of being unable to conduct their primary business, Spamhaus lifted the ban and normal business resumed. By that time the agency had lost clients and reputation and felt cheated. At no time did the agency even threaten Spamhaus with legal action, just wanting their freedom to conduct business.
At no time did Spamhaus call, warning of their impending actions before listing the Agency. At no time did Spamhaus send a warning email to the agency or their upstream provider. At no time did Spamhaus send a fax. At no time did Spamhaus fill in any of the agency’s web forms to say that they were going to effectively put them out of business.
Spamhaus wield such power, but appear to answer to no-one. They strike without warning and correspond with an arrogance akin to a Dictator. What recourse has anyone who falls foul of their methods? Who “polices” this self appointed “policeman” of the cyber world?
Do they remain “untouchable”? They certainly appear to be “uncontactable” On their own front page they boast about how a recently lost $11 million court cases is irrelevant as they are not a US company and thus untouchable by the US courts. Some will see this as an arrogant boast. Is this home page news for such a company? Home page news? I ask you?
Elsewhere they use the same mantra as many tobacco companies. “We don’t force you to use our product, but if you want it, it’s there” Is this to cover for their lack of responsibility when misdealing with “offenders”
In a recent Slashdot article the Spamhaus founder and Director, Steve Linford is likened to an X-Man. I think the Company now believe their own hype, running their organisation without recourse, without cash as their latest filed accounts show, and with wild abandon, the worst that can happen to a limited company being that they can be shut down, with no one suffering any serious financial loss. No one in the company would be hurt in any financial sense.
With all Spamhaus’s X-Man heroics, has the spam in your inbox really decreased?
Perhaps the real solution lies in the introduction of Domain Keys.
More importantly let me say it again. Who “polices” the policeman?