Jeff's Side of the Story.

There's been an ongoing discussion of the Huge Cojones remailer situation on the related newsgroups. This has a lot of relevance to our issues, and this is one of the more illuminating articles. --Tim

From: toxic@hotwired.com (Jeff Burchell) Newsgroups: alt.privacy.anon-server,alt.fan.steve-winter,alt.religion.scientology,alt.anonymous,misc.misc,alt.censorship,news.admin.censorship,alt.cypherpunks,comp.org.eff.talk,news.admin.net-abuse.misc Subject: Jeff's Side of the Story. Followup-To: alt.privacy.anon-server,alt.fan.steve-winter,alt.religion.scientology,alt.anonymous,misc.misc,alt.censorship,news.admin.censorship,comp.org.eff.talk,news.admin.net-abuse.misc Date: 1 Jul 1997 20:02:22 GMT Organization: Content, Inc ...

Anonymous (nobody@REPLAY.COM) wrote:

: > Only Jeff knows the whole story.

Actually, not even I know the whole story. If I truely knew who it was that was orchestrating this attack, it would have stopped, one way or another. The problem is, I don't know all the players (I have some suspicions, which I'll elaborate on further in a little bit) but I don't _really_ know who did it, and I really don't know why (other than a "I don't like remailers, I think I'll shut one down"). And I really don't know the background or what precipitated this.

: > But I have to ask. Could this : > just be an" I'm sick of this shit, f**k it, I quit, who needs this : > aggravation, I'll just pull the plug and go have a beer" reaction : > to what really seems like a fairly small problem.

It is not a small problem anymore when you're getting >200 complaint messages a day, plus 5-10 phone calls to your employer (and your employer's legal department). Fortunately, Wired is a very progressive company, and supported my efforts to provide anonymity, but our lawyers aren't paid to answer phone calls on my behalf. Running a remailer is one thing... getting harassed at work is an entirely different matter, and getting a THIRD PARTY harassed at work is yet another one.

But yes, The ultimate "take this thing down" decision was one made because I was sick of this bullshit. But you know what? I volunteer my time, my computer equipment, and bandwidth that is given to me as part of my salary. I do (well did) all of this because I believe that anonymity is a right, and because I have the capabilities of helping to provide anonymity to the masses. When the remailer was self-sufficient (before the attacks started), it took maybe 10 minutes of my time a day, and minimal resources on my machine. Afterwards, even after I put in the auto-blocking feature (send a blank message to a particular address and get your address blocked) and the autoresponder on the remailer-admin account, I was still getting >100 messages a day reporting abuse... almost all of it spam-bait related. I receive no benefit from running the remailer (I don't even use it myself), and when it becomes a fairly major hassle without any rewards, the decision is not a hard one to make.

And frankly, I already have enough to do, and get enough mail on a daily basis (at last check it was hovering around 600 messages/day). As soon as the remailer started taking up a lot of my time, it became time to rethink why I was running it. The moment that the spam-baiter started alerting people who had been baited, and telling them to contact me, it became personal. And I don't have time to get into personal pissing-contests. Yes, I took the easy way out, but that was my choice to make.

Anyone who doesn't run a remailer has very little right questioning my choice, because you have no idea what precipitated it. Most people reading this group have the capabilities of running a remailer (it only takes a POP account and a Windows machine to run the Winsock remailer), but very few of us actually do. Why is that? I've been running huge. cajones for just under 2 years, and it averaged just over 3000 messages a day, so my remailer was responsible for about 2 million anonymous messages in its lifetime. I think I've done my part (at least for now), it's time for someone else to do theirs. If we had 15 disposable remailers that operated for 2-3 months each before moving/going away, we'd have paths for millions more anonymous messages. And isn't that what we're really trying to provide?

: The first was doing questionable things, like installing content-based : filtering in an attempt to placate the attacker. Giving in to the demands

When I first put the filters in, I was entirely unaware of exactly what the hell was going on. It seemed that someone had a bone to pick with databasix, and was using the remailer to get databasix harassed by third parties. So, Burnore's complaint seemed reasonable at the time, and I tried to come up with a way to block spam-bait abuse, without blocking anything else (like a reply to burnore in Usenet).

See, if someone was doing to me what they appeared to be doing to Burnore, I would be pissed. I figured placating him would be the best thing to do. In hindsight, I was wrong, but at the time, it seemed like the correct decision. (Also at the same time, the SPA threatened Wired with a lawsuit because of The MailMasher, so things were a little tense between me and the legal department already, I didn't need to make them any worse.)

The final content-based-filter (there was an interim one) looked for the following things:

1. Any address at databasix (Yes, at the request of Burnore) 2. Any address from my destination block list 3. More than 5 addresses in a row, one line each, without other content in-between. 4. Patterns of particular Usenet groups. 5. Particular subject lines.

If any THREE of these items were spotted, the message got thrown into a reject bin. I periodically examined the reject bin, and can personally attest that it didn't block ANYTHING that it wasn't intended to. (The test posts reeked of spam-bait to me, and I believe were correctly blocked)

FWIW, the filters were removed about a week ago.

Because the filters were looking for a specific form of ABUSE, and not just doing basic pattern matches, I don't consider them to be "content filters". I would think that just about anyone would agree that posting lists of email addresses to mlm newsgroups would qualify as abuse, and _should_ be blocked. Blocking of this nature does NOT restrict free speech (or at least that is not the intentions of it), and it would keep the remailer out of lawsuit territory.

See, the big problem with lawsuits is not the fact that _I_ don't want to be sued. The problem is that anyone with half a brain can determine that Wired is somehow related to any remailer that I am running on their bandwidth. Wired has deeper pockets than Mr. Burchell, so they are a much better group to sue... and they are a lot more willing to give in to a threat than I am.

: What I *MIGHT* have done was to respond as follows: : : Your legal demands are unacceptable. I'd rather close the remailer than : compromise its integrity to suit your whims. But understand this -- unless : you withdraw your demands, I will not only close the remailer but also make : damn sure all of its users know exactly who forced me to take this action!

I did respond in a fashion much like this, about a week before the attacks started coming. Mr. Burnore requested a copy of my (non-existant) logs. I told him to get me something in writing, signed by his lawyer that stipulated that the logs were confidential, and not to be revealed to anyone outside of the lawyer's office.

I received a letter from Belinda Bryan. She is not registered with the State Bar of California, and is thus, not a California lawyer. I then ignored the request, and forwarded the correspondence to the State Attorney General's office (as impersonating a lawyer in CA is defined as fraud with extenuating circumstances). They have been working with me and the San Francisco DA's office. Look out DataBasix... I'm not done with you yet.

: The second mistake I perceive is not fully disclosing the circumstances that : brought down Huge Cajones, and *NAMING NAMES*. That way, even if the remailer : shuts down, other remailer operators will learn about the tactics employed : against it, know *WHO* made the demands, etc. IOW, when you get an innocent : sounding, polite complaint from xxxx@yyy.com alleging "abuse", here's the : scenario that's likely to follow ... (It's not too late to make that : disclosure, Jeff.)

In fact, now is the time to. Making a disclosure like this while I was still running the remailer would have probably been a bad move. Now that the remailer is closed, I'll name the names that I've got.

Beware... all of this is speculation, because huge.cajones was an anonymous service, not even I can say with any authority that any of the people named below had anything to do with the shutdown of huge.cajones (or The MailMasher). However, there are a number of coincidences of timing.

I still don't know what the hell is going on with DataBasix, Wells Fargo and Gary Burnore, but I suspect that someone used huge.cajones to say something extremely unflattering about Burnore (from what I can tell, he had it coming). Burnore then decided that he would make things difficult for me. First, he wanted the user who had posted something "inflammatory" about him revealed. When I told him that I couldn't do that, he carried on about mail logs and identifying the host that a message came from (the usual). I didn't explain to him that my machine keeps logs, but not anything involving a *@cajones.com address. He then requested the logs, which I denied (and told him to get his lawyer to send a request...)

I'll admit, after my second or third contact with Mr. Burnore, I no longer was particularly civil with the guy. He's a kook, and really didn't deserve my courtesy.

Between the time he first contacted me, and the time I received the letter from Belinda Bryan, is when the baiting of databasix addresses began (slowly, with just a few posts). After a while, I received requests from the other members of DataBasix (including William McLatchie (sp) (aka wotan) who actually seems to be a remailer supporter (?)).

It was at this point that I realized something was completely amiss. I asked McLatchie to please tell me the story of DataBasix, and he said that he was going to, but never did. Anyone who can tell me the story is invited to do so.

As a side note (and just because I am naming names). Peter Hartly (hartley@hartley.on.ca) yesterday spam-baited me. Fortunately, I've got good filters in place.

As another side note, I've seen nothing to make me believe that Belinda Bryan is even a real person. Anyone?

: > Given the importance of what Jeff was doing, I hope that he : > did all that he could, before declaring defeat. If that is the case, : > I commend him for a job well done. If not, why?

I can't claim to have done _everything_ that I could have done, but I did certainly make an effort. I'm not willing to go to court to defend a practice like spam-baiting (and given the current public-opinion situation and impending anti-UCE legislation, this would be a terrible test-case).

I am not new to threats of lawsuit, even ones that come from legitimate lawyers. About 8 months previous, I was threatened repeatedly by the legal wing of the "Church" of Scientology. I answered with a letter from my lawyer that explained the policies of the remailer, and threatened a harrassment lawsuit if the "Church" contacted me again asking for information (that they now knew I didn't have) about a remailer user. They complied, and went away (and haven't been too difficult with other remailer operators lately).

: Agreed. Otherwise, these "asshole(s)" are simply going to do it all over : again against another remailer, eventually taking them all down one at a time. Except that right now, new remailers are springing up. If we could get three more online for every one shut down, it wouldn't much matter, would it? I may very well end up running a mailer again in the future, but if I do, it will probably be either a throwaway exit-man or a truely anonymous middleman (i.e. nobody will actually know who is running it). It also will probably be hosted outside of the United States (Floating in international waters with a sat feed would be nice).

: It's time for them to stand up and say "Next time you come for one of us : he's : not going quietly as the others have. You'll have to face ALL of us at once, : instead."

Aah, you imagine much more solidarity among remailer operators than actually exists. It doesn't work that way. It would be nice if it did, but many of us are running remailers on borrowed bandwidth (or have other "situations" to be concerned about). Being the squeaky wheel is not always a good idea for many of the operators (most of whom try to keep a low profile).

The reality is, for all the good they do, remailers are tools that can very easily be abused. And, as the internet gets more and more commonplace, the average Joe and Joesphine, who don't have the strict Cyber-Libertarian viewpoints that are shared by most of us old-timers, will start to wonder just why anyone would want to run a service that allows anyone to speak their mind without fear of reprisal. When you get people with more extreme viewpoints (the ones who have a really legitimate need for anonymity) posting all kinds of stuff to all kinds of places, it will get the attention of Middle-America, which will then bring it to the attention of legislators. Any time a legislator can say "This is a blow to Child Pornographers and others who hide behind anonymity to commit crimes without fear of reprisal" you can guarantee that the bill will pass.

When that happens, we're in trouble. America is scared of computers, and remailers are thought to be havens for the big 3 (Terrorists, Organized Crime and Child Pornographers). Now that the spammers are involved (spammers possibly being hated more than the big 3), most users are exposed to anonymous remailers in negative ways (Imagine what you would think if the first time you heard about the existance of remailers, it was because someone had spam-baited you, and then told you about it).

The right to anonymity in the US will be legislated away within 18 months, partially because of spam. I do hope there's a _good_ test case waiting, and someone willing to fight it to the end, but I have my doubts. Ultimately the remailer network will be forced to move offshore, the way Crypto development currently has.

Don't like the News? Go out and make some of your own.

-Jeff

|o| |o| |o| Jeff Burchell toxic@wired.com |o| |o|- - - - - - - - - - - - - - - - - - - - - - - - - -|o| |o| I am not speaking for anyone but myself. |o| |o| |o|

-- There's something wrong when I'm a felon under an increasing number of laws. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."