BLACKLIST: ISPs block e-mail transmissions based on data from anti-spam group

ScubaDiving.com, a Web site operated by Rodale, was shut down for three days after an anti-spam group complained that the publisher had spammed consumers.

The shutdown cost the company about $1,000 in lost subscriptions and an untold number of visitors. And other firms have had similar experiences.

Some call it blacklisting, others call it blackholing. But whatever it’s called, it’s striking fear into the hearts of direct marketers.

The most visible blackhole group – and therefore the most feared – is Mail Abuse Prevention System LLC (MAPS), Redwood City, CA. It maintains a list of 3,000 Internet protocol (IP) addresses of firms it believes are guilty of spamming. MAPS subscribers routinely monitor the so-called Real-time Blackhole List (RBL) and either delete mail or bounce it back to the firms listed.

“If you got on that list and couldn’t get off, you would be out of the e-mail business,” says one high-level executive who requested anonymity. “It basically shuts you down.”

Experts say that no firm is immune from landing on the list, which can result in up to 50% of the company’s messages sent being blocked from reaching their intended recipients. Also blocked are e-mail messages going to businesses, existing customers, and consumers who have opted in.

MAPS, a nonprofit group that refers to itself as a “project,” has 20,000 unique subscribers worldwide, including Internet service providers (ISPs), corporations, government agencies and individuals, says Nick Nicholas, staff director of policy and communications for MAPS and a self-described evangelist.

Several direct marketers have already been stung by the group, which has 13 people working for it (up from three last year).

FloNetwork Inc., for example, accidentally transmitted 2,000 e-mails to individuals who had opted out and was “quickly” contacted by the blackhole group, says Regina Brady, vice president of strategy and partnerships for FloNetwork, Toronto.

But after FloNetwork explained the mishap and assured MAPS it would take steps to prevent a similar incident, it was taken off the list. “They are a potent source and if you don’t realize their power and pay attention, you’ve got a major problem,” says Brady. “It’s important for our whole livelihood to make sure this doesn’t happen.”

The MAPS Web site (www.mail abuse.org) claims that “no Internet user has any fundamental right to send you e-mail or any other kind of traffic.” It also argues that users are annoyed by e-mail unless they have opted in to receive the information.

In addition to the RBL, which lists the IP addresses of those deemed to be sending unsolicited or spam e-mail, MAPS maintains two other lists. The Dial-Up User List identifies the IP addresses of mailers using direct connections to recipients’ mail servers, without using their ISP’s mail server as a relay or gateway. And the Relay Spam Stopper is a database of non-secure mail servers used to relay unwanted e-mail advertising.

Between the three lists, Nicholas estimates that MAPS is able to block 75% of all spam, although subscribers do not have to block all IPs listed.

“Any subscriber has the right to go along with a particular listing or not,” says Nicholas.

Ziff-Davis had its e-mail blocked for two days, and e-mail service provider Exactis.com had two of its IP addresses listed for using an open relay, says Nicholas.

MAPS also lists corporate IP addresses and ISPs. For example, America Online and Earthlink have both been listed for brief periods.

In addition, Compuserve had a number of its mail servers listed for about three weeks for using an non-secure mail server, and only after it acknowledged the problem and set a date to fix it was it released from the list.

“All major service providers worry a lot about the [blackhole list],” says Derek Scruggs, permission advocate for MessageMedia Inc., Boulder, CO. “If any one of us got on the RBL, several hundred of our clients could not deliver e-mail. That’s a real competitive disadvantage.”

MessageMedia is so wary of groups like MAPS that it has fired clients for non-compliance with opt-in procedures. “It’s fair to say the [blackhole list] makes us be a lot more vigilant,” says Scruggs.

Some experts say MAPS is right to try to eliminate spam and ensure that marketers follow opt-in guidelines. However, others characterize the group’s efforts as vigilantism and its volunteers as a group of techno-renegades so unfamiliar with the marketing side of business that their decision-making is arbitrary and unfair.

“The good is that they’re helping to drive out the true spammers,” says David Taylor, executive editor for ScubaDiving.com. “The bad is that they’re overzealous at times, leading them to attack and hurt legitimate businesses customers want to know about and want to do business with.”

Some industry observers say that MAPS is courting a lawsuit – and Nicholas agrees. MAPS is threatened with legal action on a weekly basis, he says, but it has not yet been sued. However, the group would welcome a legal challenge to “prove our actions are legitimate and that we are not violating any laws by doing what we’re doing,” he adds. “And I think the fact that we haven’t been sued is a de facto acknowledgement that we’re operating within the law because this offer has been on the table for two and a half years.” A link on the group’s site reads: “How to Sue MAPS.”

Others says MAPS is trampling on the First Amendment right to free speech. But Nicholas claims the First Amendment is not absolute, and that there are limits to free expression – for example, one can’t scream “Fire!” in a crowded restaurant.

“We’re not really blocking anyone’s right to free speech,” asserts Nicholas. “We’re exercising our right not to listen. So if people want to listen to junk mail, then they should be allowed to and if they don’t want to listen to it they shouldn’t be forced to.”

The e-mail promotion that landed ScubaDiving.com on the blacklist was its first attempt at e-mail marketing. It transmitted 40,000 messages to addresses it had collected via desktop software. Taylor admits that the data-capture technology needed some fine-tuning.

MindSpring (now Earthlink Inc.), Atlanta, was hosting the site at the time of the transmission. It shut down the site with only a few hours’ notice after receiving complaints from unspecified blacklist groups and anti-spam activists, Taylor alleges.

Earthlink executives could not confirm that MindSpring shut down the site. However, they do say that ScubaDiving.com is now listed as an inactive customer. The ISP requires customers to adhere to its acceptable use policy and has shut down the sites of violators.

“If [a customer] sent unsolicited mail, then we don’t need an outside group to threaten us or try to apply pressure,” says Tom Tatom, abuse investigator for Earthlink. “Once we’re made aware that our policies have been violated, we’ll take action.”

(While anti-spam groups abound, sources cite only one other service that maintains an anti-spam list: New Zealand-based Open Relay Behavior ModificationSystem).

So what did ScubaDiving.com do? It found another ISP to temporarily host the site before investing heavily in setting up its own ISP. “We promised never to shut ourselves down,” says Taylor. The new service is available only for the ScubaDiving. com site.

Developing one’s own ISP is an expensive proposition that includes purchasing a router, bandwidth and hiring an administrator. Start-up costs to send and receive e-mail can range from about $2,000 for a router box, anywhere from $300 to $15,000 for bandwidth and $30,000 to $80,000 for an administrator, according to Taylor. “Most people,” he says, “do not have the resources to develop their own Internet service and therefore should seek out and make partners with bulk, e-mail-friendly ISPs.”

A Internet search for such ISPs turned up 3,372 hits. But Taylor cautions not all services are trustworthy, and some do indeed promote spam. “There are the legitimate ones out there that understand the effect anti-spammers have on your business and will protect you from them,” he says.

One of the most significant dangers in getting into e-mail marketing lies in the contract with the ISP. “Most contracts give the ISP the ability to shut down your Web site, to cut you off from access to the Internet without warning and on the basis of uninvestigated complaints,” notes Taylor.

“By putting your business in the hands of your ISP,” he adds, “you’re also putting your business in the hands of anti-spammers because their tried-and-true technique is to threaten the ISP with blackhole unless that ISP shuts down your site. And whenever an ISP is given a choice between you having access to the Internet and all its other customers having access to the Internet, you will always be the loser.”

Ian Oxman, president of ChooseYourMail.com, a Chicago-based e-mail permission marketing service, says traditional DMers moving from postal mail to e-mail are especially vulnerable to groups like MAPS. For one thing, they may be unfamiliar with the full impact of spam and the negative emotions associated with unwanted e-mail, such as screaming customers and brand damage.

“With postal mail the biggest risk is losing money,” says Oxman. “But in e-mail, you could be stepping into a hornets’ nest.”

Experts say one risk is that legitimate e-mail transmission service bureaus and major e-mailers that transmit millions of messages every day are likely to reach a handful of recipients who may complain. And those complainants quite often gripe not only to the mail sender but to the ISP and anyone else along the electronic path.

“People sign up today and forget tomorrow,” says John Lawlor, president of The E-mailChannel, Boca Raton, FL, and co-chair of the Association for Interactive Media’s Council for Responsible E-mail. “But that doesn’t hold weight with [MAPS]. Overall they are well intentioned but the problem is there is no due process in place and they are punishing people who are not the people they should be punishing.”

The E-mailChannel landed on the blacklist briefly because of a server that wasn’t set up properly, says Lawlor.

NetCreations transmits 2 million to 3 million e-mails daily and does hear from MAPS “from time to time,” says CEO Rosalind Resnick. To avoid such problems, the company employed a double opt-in policy several years ago. The policy requires that individuals who had previously opted in must receive a confirmation e-mail. This creates a paper trail to use as proof of the date, time and IP address of the transaction. “The double opt-in policy is one reason we have few problems with the RBL,” says Resnick.

“While some direct marketers may take issue with some of their practices, I think the RBL group represents a very important voice in the Internet community – and a voice that direct marketers ignore at their peril,” she adds.

In fact, Resnick and other experts urge that mail servers establish a relationship with groups like MAPS before a problem occurs.

A meeting in late April at the AIM Interact 2000 conference in Palm Springs, CA, brought together representatives from a number of e-mail service providers, including MessageMedia Inc. and Exactis.com. They were joined by a member of MAPS, and by AIM executive director Ben Isaacson. The participants discussed a number of options, including instituting a double opt-in policy industrywide.

“There has to be a way within the industry for people on the marketing side and the technical side to work together to help resolve spam,” says Lawlor.

Nicholas acknowledges that the meeting was an effort to build relationships with the direct marketing community.

Worried about being blackholed? You can check if you’ve been listed by visiting www.mailabuse.org.