🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

My reposting of most of the email logs (save for the last letter I have
sent Caputo).

Please note that Caputo's claim that I "gave permission" for him to repost
the logs is not entirely accurate.  I told him that with *his* permission
that *I* would repost the logs.  I do think that that needs to be
corrected.

- -- 
- -Windigo The Feral (NYAR!)
Fight the Woodside Literary Agency! Support the Jayne Hitchcock HELP fund 
<http://www.geocities.com/Hollywood/6172/helpjane.htm> * Boycott Internet 
Spam! <http://spam.abuse.net/spam> * Ban Spam Now! <http://www.cauce.org>

<forward follows>

Date: Thu, 13 Nov 1997 07:05:16 -0500 (EST)
From: Follower of the Clawed Albino <afn23950@afn.org>
To: Chris Caputo <ccaputo@alt.net>
Subject: Re: Question for you

(posted and emailed)

On Wed, 12 Nov 1997, Chris Caputo wrote:

> Hi.
> 
> > If they're not willing to do *that*, people are going to keep pointing
> > out to them that they're not running an anonymous posting service and
> > that they need to let one know whom to complain to.
> 
> How would us being an anonymous posting service make a difference in how
> you reacted to the posts you felt were abusive?  Many posters do come to
> us for anonymity, and I am curious as to why our protection of their
> privacy is not something you think we should do, given that to them we are
> an anonymous posting service.

For starters, most anonymous posting services do have fairly strict rules
regarding abuse of their service.  This includes path forgeries, etc.

This includes your pseudonymous "anonymous account" services like dhp.com
as well.

If you were working like the fifteen-odd anonymous posting services I've
seen on the net--including the two or three pseudonymous-account anon
services--you'd have blocked them from abusing your servers in such fashion.

(Yes, I have had direct experience with persons attempting abuse via anon
remailers.  I had to help University of Waterloo track down a person on alt.
barney.dinosaur.die.die.die who was doing a mailbombing/harassment/forged
solicitation campaign against a U of Waterloo student, which included at
points the abuse of very nearly *every* anon remailer service available at
the time.  The person, in fact, ended up being blacklisted from anon
remailers.)

Now, as I understand it, Altopia is a pay service just like Airnews or Zippo
or such.  It's not a pseudonymous service like dhp.com or khijol.org is.
Not only are you dealing with your AUP but those of downstream providers.
Most of them also have policies for dealing with stuff like path forgeries
and deliberate flooding, etc.--often stricter than Altopia's.

I understand you've less strict policies than most ISPs.  I note that your
customers' sites might have more strict rules.  Altopia doesn't advertise
itself as an anonymous posting service and it's really a disservice to claim
one is.  

I still see no real reason why one can't add an NNTP-Posting-Host to the
headers, or at least the IP address to the Path:.  Most of the sites with a
real problem with people connecting to other NNTP servers are going to have
port 119 firewalled off anyways.  Most of the other sites don't have a major
problem as long as their users aren't doing stuff like posting warez or
forging Paths to implicate other sites or flooding or spamming or forging
moderated approval to posting or whatever.

IF they're doing those, that's net.abuse according to most ISPs.  Sorry, but
the point where someone starts in net.abuse, you cut off the feed (if you
are an anon provider) and notify their home ISP, or you leave alone and post
the NNTP-Posting-Host in the headers, and then ordinary folks can deal with
the persons committing abuse.

That's my point.  Nothin' more, nothin' less.  If you're gonna play the
"anon provider" game, then you need to respond in timely ways and you need
to keep yer nose clean on stuff.  Not censoring, but not allowing folks to
abuse it either.

If you want to keep a hands-off approach, you need to provide some way where
(in those cases where there is net.abuse going on) folks can track it and
leave you out of the mess.

> Thank you for your time,
> Chris Caputo
> President, Altopia Corporation

And thanks for responding,
- -wtf (nyar!)



Date: Fri, 14 Nov 1997 02:01:13 -0500 (EST)
From: Follower of the Clawed Albino <afn23950@afn.org>
To: Chris Caputo <ccaputo@alt.net>
Subject: Re: Question for you

(Again, posted and emailed)

On Thu, 13 Nov 1997, Chris Caputo wrote:

> On Thu, 13 Nov 1997, Follower of the Clawed Albino wrote:
> > I still see no real reason why one can't add an NNTP-Posting-Host to the
> > headers, or at least the IP address to the Path:.  Most of the sites with a
> > real problem with people connecting to other NNTP servers are going to have
> > port 119 firewalled off anyways.  Most of the other sites don't have a major
> > problem as long as their users aren't doing stuff like posting warez or
> > forging Paths to implicate other sites or flooding or spamming or forging
> > moderated approval to posting or whatever.
> 
> The NNTP-Posting-Host: header is not added to posts from direct customers
> of Altopia because we see that as a violation of the customer's privacy.
> We are the customer's admins and so complaints about their activities
> should come only to us.

The customers of Altopia are not only *your* customers--to my knowledge,
Altopia provides NNTP service..

All of your NNTP customers get their *primary* access from another host.
 
> Would you be happier if we had an NNTP-Posting-Host: like
>  
>    NNTP-Posting-Host: news.alt.net
> 
> so that you would know for sure that the posts were made from our service? 
> This is apparently acceptable for Usenet II, but I am curious as to
> whether you think it would be adequate.  This would avoid any confusion
> caused by Path: pre-loading.

Here's my suggestions on what to do:

1) If you're running a purely anonymous posting service:

   Either have all posts with a From: line pointing to something like
   "nobody@alt.net" (c2.org used this successfully), or set up some sort
   of pseudonym-system like anon.penet.fi formerly did and dhp.com does now.
   (Basically, each user has pseudonymous login and password--you could well
   possibly do this via authinfo.)

2) If you mean to keep it semianonymous:

   1) Add NNTP-Posting-Host: alt.net
   2) Require a mailable email address for posting.  (Possibly by
      "ack-back".

3) If you still want to allow munged addresses, etc. and aren't willing to
   take the steps needed to set up a separate anon-posting service, you
   need to add some way to indicate the IP number or have a way to reply
   quickly--even if it's a ticket number for abuse--to requests to stop it
   or forward the abuse complaint to the home ISP of the offender.

   (There is a specific reason I insist on this a lot.  In the case of the
   three or four individuals from alt.net who were trying to flood AHWW with
   about two or three other people, the persons likely have done it before
   using a myriad of open NNTP servers [all the way to last year].  There 
   was also the strong possibility that one or more of the alt.net posters
   were in fact the SAME poster, using multiple From: lines.  Again, they
   HAVE done this in past, and the only way to determine the source is by
   checking IP numbers.

   (Another good case in point is another alt.net user who seems to be 
   trying to start the "Mahmoud" posts again, only this time he is using
   a munged "From" line meaning to falsely implicate alt.fan.karl-malden.
   nose.  He may be the same person as the "Mahmoud" poster, he may be the
   same as the "meowbot" or the other two or three posters from alt.net
   who were involved in the AHWW troubles, or it may be yet another copycat.
   One cannot determine this without checking IP numbers.)

> > IF they're doing those, that's net.abuse according to most ISPs.  Sorry, but
> > the point where someone starts in net.abuse, you cut off the feed (if you
> > are an anon provider) and notify their home ISP, or you leave alone and post
> > the NNTP-Posting-Host in the headers, and then ordinary folks can deal with
> > the persons committing abuse.
> 
> An anonymous posting service, by definition, would not be able to identify
> the posters of abuse, so I am confused as to why you think they could. 

In the case of the poster harassing the U of Waterloo student, she abused
(in addition to the anon reposting services) at least one web-to-news
gateway that someone had set up without authorisation as an anon server
(which turned out to have a broken CGI script that made all posts appear to
be from webmaster@linnet.com) and, in addition, Zippo and DejaNews.  Anon.
penet.fi was able to determine the source and blocked it; the others either
firewalled off waterloo.ca (after checking against logs or finding similar
abuse had occured through other servers) or shut down their servers until
they could be better secured.  The person persistently abusing c2.org was
part of the reason that anon service had to shut down for some time, till
they could find a way to secure their servers against net.abuse without
compromising security.

Nym.alias.net and Mailmasher, if memory serves, have designed ways to
prevent persistent abuse of their servers; you might want to ask the admins
there to see if they can help.  Cypherpunks-l might also be able to help in
this regards.

> > That's my point.  Nothin' more, nothin' less.  If you're gonna play the
> > "anon provider" game, then you need to respond in timely ways and you need
> > to keep yer nose clean on stuff.  Not censoring, but not allowing folks to
> > abuse it either.
> 
> We research complaints and handle them as we believe appropriate.  We
> generally do not respond to complainers because it is usually none of
> their business how we handle the complaint.

Most sites worried about privacy concerns will state one of the two
following:

1) the account is not abusing the net, or
2) the account is being dealt with according to the AUP.

Many persons are getting worrisome impressions regarding Altopia precisely
because you are *not* responding to persons who are complaining, often about
bona fide net.abuse.

> In your case you were not responded to for a number of reasons.:
> 
>  1) Your definition of abuse was vastly different than ours and so it
>     appeared that it would have been futile for us to engage in a
>     discussion with you. 

1) According to your own Acceptable Use Policy, interfering with a Usenet
   newsgroup (not merely trolling, but deliberately trying to interfere with
   it's workings) is unacceptable.  I sent you repeated evidence of this.

2) According to your own AUP, much of the stuff such as path forgery was
   likely a violation.

3) I'm going to be flat out and state that some of Altopia's policies--
   not all, mind, but several of them--seem to be at variance with 
   accepted standards of what is and is not abuse of Usenet.  Among
   these are, apparently, that forgery of Approved: headers for posts
   to moderated groups is accepted as tolerable at Altopia (this will
   get you yanked from nearly EVERY other provider, and will also get
   you *rapidly* banned from anon remailers) and that posting of binaries
   to non-binary newsgroups (again, this *is* considered a form of net.
   abuse) is also tolerated.  If you have problems with this, I suggest
   strongly that you take it up with the readers of news.admin.net-abuse.
   usenet--it's the admins of Usenet in general who decide what is and is
   not net.abuse, not myself.

>  2) When you started threatening legal action, we definitely were not
>     going to respond, because after that point we have to treat things as
>     if they will end up in court.  Correspondence at that point would have
>     been pre-trial discovery and that would not be appropriate without the
>     presence of our corporate attorney. 

I was noting that legal action was a definite possibility to inform you of
the seriousness of what your users were doing, Chris.  And it would not be
your lawyer getting involved with *me* if it'd gotten to that point--it
would be your lawyer discussing things with law enforcement.

I pointed out to you, repeatedly, that the posts were not only an attempted
denial of service attack, they were also meant as harassment *and* they
furthermore often contained heavily forged headers designed to implicate
innocent sites.  The parties involved in this *have* done this before, 
for what it's worth; this is a group of four or five individuals who have
been doing this for upwards of a *year*.  So far, your site is the
*solitary* one which has been uncooperative in stopping the abuse.

If you wish, I'll gladly provide logs and other info of some of their past
attempts, most of them through open NNTP servers.

I, frankly, was hoping that I wouldn't HAVE to have the cops subpoena logs
from your site.  My point in this was that this is a serious situation--
serious enough that I am considering calling in the cops if necessary to get
it stopped.  (There were other incidents, likely by the same parties, that
pushed me to that point.  The first was that my fiance, who has not posted
to Usenet in *months*, was listserv-bombed, possibly by the same person
posting under the "meowbot" aliases; the second was that threats were being
directed against a project I am in, and after the listserv-bombing of my
fiance I seriously considered disinvolving myself from the project so that
the rest of the members could avoid harassment.)
 
>  3) It is difficult to take seriously correspondence from someone with the
>     name "Follower of the Clawed Albino".  If this is your real name, I
>     apologize but please try to understand our position. 

1) FWIW, other sites have *happily* accepted posts and email from this
   address and alias.  

2) If you had any questions, you could have *easily* asked me and I would
   have provided names of folks who can vouch for me.  (For starters,
   Chris Lewis could have.)

3) It should not *matter* what the nym or name of the person is who is
   reporting net.abuse from your site.  The important thing is that *a
   potential net.abuse situation is occuring*.

4) With the comment above, you have just indirectly shot any claims on
   why Altopia should not add IP-tagging, etc. out of the water.  If
   you distrust net.abuse complaints from me simply because of my nom
   de plume (which I use, in part, to prevent harassment from spammers
   when I make net.abuse complaints--I'm sure NANA* can enlighten you 
   on reasons why folks might want to do this) why should anyone trust
   ANYTHING from alt.net whatsoever?  At least I can be traced to a
   mailable address; I CANNOT say the same for the persons making the
   posts I have complained about.

>  4) Once you started sending multiple messages per day, from our
>     perspective you appeared to be unstable and irrational.  The tone of
>     your phone calls reaffirmed this suspicion.  This may not be the
>     case, but it seemed likely to us that you would take our responses and
>     spread them around Usenet or in court, out of context. 

Well, the reason I was sending you multiple messages per day was that *three
or four of your users were deliberately trying to flood newsgroups and at
least one was deliberately forging paths to make it look as if it came from
elsewhere*.  After two weeks of *no* response whatsoever, my mails may have
sounded curt.  To be perfectly frank, I was beginning to consider seriously
the possibility that alt.net might be outright rogue.

My phone calls, FWIW, were made after my fiance was listserv-bombed, and I
think you can understand how I *might* be a bit concerned.  

Let me put it this way--*you* put up with an attempted newsgroup flood that
is part of a series of them, that you know from *their own posts* is
targeted at you, you complain to a site for two weeks to *please* give you
logs so you can find out where it is coming from (and hopefully colloborate
it with ten other logs you have, to see if they've moved to a new ISP), and
then someone who likely is one of the very perps using your site decides to
listserv-bomb my fiance for no reason whatsoever other than he *is* my
fiance, and a net.kook who joined in the campaign posted this in a FAQ using
his *old* email address, not the one he uses now and which has not appeared
on Usenet in *months*.  This tends to shake one up.  A *lot*.

As for the multiple emails/day at the last of it, I was sorting them by
From: line.  At least three different "From" lines were used in the AHWW
posts (four, if you count both morphs of the "meowbot") and one, possibly
two, used/being used in the "Mahmoud/afkmn.org" posts.  As I was not sure
whether this was the same person, one or two people using multiple morph
addresses, etc. I could not be sure whom is doing this.  As I know alt.net
isn't open, I felt safer doing it *that* way instead of batching them ALL
together in a mail or two (I'd likely have had to split the mail anyways,
due to the daily volume of posts in many cases).

> We did follow-up on your complaints when we felt the complaint was
> justified.

I noticed that the flooding of AHWW from alt.net, as well as the initial
morph of "mahmoud", seems to have stopped.  I thank you for this.

I *will* note that a new morph, who may or may not be the same as the
"Mahmoud" poster, seems to be trying to stir up the same stuff again.  He's
posting with a munged From: line pointing to afkmn.org:

<begin excerpt>

Path: news-f.iadfw.net!thereisnocabal!news.airnews.net!cabal10!newsfeed.
direct.ca!logbridge.uoregon.edu!su-news-hub1.bbnplanet.com!news.bbnplanet.
com!news.alt.net!usenet
From: cupcake@afkmn.org (Cupcake The Cat)
Newsgroups:
news.admin.net-abuse.email,news.admin.net-abuse.misc,alt.fan.karl-malden.
nose,news.admin.censorship,news.groups,alt.politics.democrat,soc.culture.jewish
Subject: Re: CAUCE members demand censorship
Date: Wed, 12 Nov 1997 04:31:34 GMT
Organization: TUNA !
Lines: 24
Message-ID: <34693019.6227877@news.alt.net>
References: <34662752.61E9@netcom.ca> <646em6$ihn$2@usenet48.supernews.com>
<34684fb2$1$fuzhry$mr2ice@news1.mnsinc.com>
<64a3dj$sld$2@usenet85.supernews.com> <64adm7$ag1@garcia.efn.org>
<64aqp1$kap$2@usenet76.supernews.com>
X-Newsreader: Forte Free Agent 1.1/32.230
Xref: news-f.iadfw.net news.admin.net-abuse.email:120707
news.admin.net-abuse.misc:192530 alt.fan.karl-malden.nose:128472
news.admin.censorship:49934 news.groups:329561 soc.culture.jewish:409343
 
On 11 Nov 1997 23:46:41 GMT, ricardo@primus.paranoia.com (Ricardo Hector
Gonzales) wrote:
 
>Gary Frazier (gfrazier@efn.org) wrote:
>: 
>: Shut up, Rickie.  No one gave you permission to speak.
>: -- 
>:                                                Gary
>: http://www.efn.org/~gfrazier
>: Fight Spam!  Join CAUCE!  http://www.cauce.org
>               ^^^^^^^^^^^
>
>Thanks for representing the censorship motivation of your organization.
>People have been saying for a long time that CAUCE is only interested
>in censoring individuals and your post is proof of that.
 
CAUCE has no use for JEW SPAMMERS like you, Ricardo.  If only
the Spanish were more efficient during the Inquisition so that your
ancestors did not escape to Mexico, the net would be a better place.
 
<end excerpt>

Now, this isn't to the point of bona fide net.abuse yet.  He's not flooding,
he's not doing sillybuggers with the Path.  I don't know what exactly you
did re the "Mahmoud" poster, but if he got booted he MIGHT have gotten back
on (I don't know, honestly, if you blacklist folks you boot).  I won't ask
you to nuke this one--yet.

I really *would* have liked to known where some of the AHWW floodposts were
coming from (that were through alt.net).  In particular, I'm still half
curious if some of 'em came through Springfield, MO POPs (during the last
major waves of this, the major culprit was someone using a Springfield, MO
POP of Smartnet) of ISPs, or if any came from Carnegie Library (someone's
been using open NNTP servers to binary-bomb the same groups being hit by the
"naughty noser" problems).  

I'd be happy, though, even with a note that "this is being dealt with".
That and being able to know where abusers are coming from--even if you boot
them off, they will often move to another provider or to open NNTP servers
until the "home" account is cut off.  (This is another reason it's kind of
important to determine whom is posting from alt.net, if you're not intending
to go full whole hog with the anonymous posting service.)

> Chris Caputo
> President, Altopia Corporation

- -wtf (nyar!)




- From ccaputo@alt.net Sat Nov 15 22:16:09 1997
Date: Wed, 12 Nov 1997 23:33:07 -0800 (PST)
From: Chris Caputo <ccaputo@alt.net>
To: Follower of the Clawed Albino <afn23950@freenet5.afn.org>
Subject: Question for you

Hi.

> If they're not willing to do *that*, people are going to keep pointing
> out to them that they're not running an anonymous posting service and
> that they need to let one know whom to complain to.

How would us being an anonymous posting service make a difference in how
you reacted to the posts you felt were abusive?  Many posters do come to
us for anonymity, and I am curious as to why our protection of their
privacy is not something you think we should do, given that to them we are
an anonymous posting service.

Thank you for your time,
Chris Caputo
President, Altopia Corporation

- From ccaputo@alt.net Sat Nov 15 22:16:18 1997
Date: Thu, 13 Nov 1997 11:20:38 -0800 (PST)
From: Chris Caputo <ccaputo@alt.net>
To: Follower of the Clawed Albino <afn23950@afn.org>
Subject: Re: Question for you

On Thu, 13 Nov 1997, Follower of the Clawed Albino wrote:
> I still see no real reason why one can't add an NNTP-Posting-Host to the
> headers, or at least the IP address to the Path:.  Most of the sites with a
> real problem with people connecting to other NNTP servers are going to have
> port 119 firewalled off anyways.  Most of the other sites don't have a major
> problem as long as their users aren't doing stuff like posting warez or
> forging Paths to implicate other sites or flooding or spamming or forging
> moderated approval to posting or whatever.

The NNTP-Posting-Host: header is not added to posts from direct customers
of Altopia because we see that as a violation of the customer's privacy.
We are the customer's admins and so complaints about their activities
should come only to us.

Would you be happier if we had an NNTP-Posting-Host: like
 
   NNTP-Posting-Host: news.alt.net

so that you would know for sure that the posts were made from our service? 
This is apparently acceptable for Usenet II, but I am curious as to
whether you think it would be adequate.  This would avoid any confusion
caused by Path: pre-loading.

> IF they're doing those, that's net.abuse according to most ISPs.  Sorry, but
> the point where someone starts in net.abuse, you cut off the feed (if you
> are an anon provider) and notify their home ISP, or you leave alone and post
> the NNTP-Posting-Host in the headers, and then ordinary folks can deal with
> the persons committing abuse.

An anonymous posting service, by definition, would not be able to identify
the posters of abuse, so I am confused as to why you think they could. 

> That's my point.  Nothin' more, nothin' less.  If you're gonna play the
> "anon provider" game, then you need to respond in timely ways and you need
> to keep yer nose clean on stuff.  Not censoring, but not allowing folks to
> abuse it either.

We research complaints and handle them as we believe appropriate.  We
generally do not respond to complainers because it is usually none of
their business how we handle the complaint.

In your case you were not responded to for a number of reasons.:

 1) Your definition of abuse was vastly different than ours and so it
    appeared that it would have been futile for us to engage in a
    discussion with you. 

 2) When you started threatening legal action, we definitely were not
    going to respond, because after that point we have to treat things as
    if they will end up in court.  Correspondence at that point would have
    been pre-trial discovery and that would not be appropriate without the
    presence of our corporate attorney. 

 3) It is difficult to take seriously correspondence from someone with the
    name "Follower of the Clawed Albino".  If this is your real name, I
    apologize but please try to understand our position. 

 4) Once you started sending multiple messages per day, from our
    perspective you appeared to be unstable and irrational.  The tone of
    your phone calls reaffirmed this suspicion.  This may not be the
    case, but it seemed likely to us that you would take our responses and
    spread them around Usenet or in court, out of context. 

We did follow-up on your complaints when we felt the complaint was
justified.

Chris Caputo
President, Altopia Corporation

- From ccaputo@alt.net Sat Nov 15 22:16:35 1997
Date: Fri, 14 Nov 1997 09:11:52 -0800 (PST)
From: Chris Caputo <ccaputo@alt.net>
To: Follower of the Clawed Albino <afn23950@afn.org>
Subject: Re: Question for you

On Fri, 14 Nov 1997, Follower of the Clawed Albino wrote:
> (Again, posted and emailed)

I am not sure where you are posting these, but please note that I consider
it rude for you to have done so without my permission.  This lowers my
opinion of your credibility.  If you continue to do it, please at least
include something that says I asked you not to and that you are doing it
explicitly without my permission.  I should have said something in my
first reply. 

I am not worried about the things I say becoming public, but that does not
give you the right to publicize them at your whim and out of context.  My
hope is to understand your unique mentality in a private manner, so as to
possibly come up with solutions to the problems you have brought up.

If you continue to post my response, please at least tell me where to look
for follow-ups. 

> > The NNTP-Posting-Host: header is not added to posts from direct customers
> > of Altopia because we see that as a violation of the customer's privacy.
> > We are the customer's admins and so complaints about their activities
> > should come only to us.
> 
> The customers of Altopia are not only *your* customers--to my knowledge,
> Altopia provides NNTP service..
> 
> All of your NNTP customers get their *primary* access from another host.

Many of our customers come to us because they want a service where they
don't have to worry about their primary provider becoming involved in
their activities on Usenet.  Reasons for this vary.  Here are some
examples:

  - A customer posting controversial speech from a company account does
    not want to put their job at risk. 

  - A customer posting controversial speech from a country that does not
    allow their thoughts to be uttered, does not want to put their life or
    freedom at risk. 

  - A customer posting details about sexual abuse to alt.sexual.abuse or
    another group may not want their hometown provider to be aware of
    their experiences.  Who knows, maybe it was the provider themselves
    that participated in the sexual abuse.

  - A customer may not want their gender to be known on Usenet.

We will not change our privacy policy in any way with respect to this, so
I recommend you don't waste your time asking for a change.  The actions
that we disagree on as to whether they are abuse, do not warrant us taking
away our customer's privacy or raising our liability.  Any site that
disagrees with our privacy policy is welcome to alias out "news.alt.net". 

> Here's my suggestions on what to do:
> 
> 1) If you're running a purely anonymous posting service:
> 
>    Either have all posts with a From: line pointing to something like
>    "nobody@alt.net" (c2.org used this successfully), or set up some sort
>    of pseudonym-system like anon.penet.fi formerly did and dhp.com does now.
>    (Basically, each user has pseudonymous login and password--you could well
>    possibly do this via authinfo.)
> 
> 2) If you mean to keep it semianonymous:
> 
>    1) Add NNTP-Posting-Host: alt.net
>    2) Require a mailable email address for posting.  (Possibly by
>       "ack-back".
> 
> 3) If you still want to allow munged addresses, etc. and aren't willing to
>    take the steps needed to set up a separate anon-posting service, you
>    need to add some way to indicate the IP number or have a way to reply
>    quickly--even if it's a ticket number for abuse--to requests to stop it
>    or forward the abuse complaint to the home ISP of the offender.
> 
>    (There is a specific reason I insist on this a lot.  In the case of the
>    three or four individuals from alt.net who were trying to flood AHWW with
>    about two or three other people, the persons likely have done it before
>    using a myriad of open NNTP servers [all the way to last year].  There 
>    was also the strong possibility that one or more of the alt.net posters
>    were in fact the SAME poster, using multiple From: lines.  Again, they
>    HAVE done this in past, and the only way to determine the source is by
>    checking IP numbers.
> 
>    (Another good case in point is another alt.net user who seems to be 
>    trying to start the "Mahmoud" posts again, only this time he is using
>    a munged "From" line meaning to falsely implicate alt.fan.karl-malden.
>    nose.  He may be the same person as the "Mahmoud" poster, he may be the
>    same as the "meowbot" or the other two or three posters from alt.net
>    who were involved in the AHWW troubles, or it may be yet another copycat.
>    One cannot determine this without checking IP numbers.)

Thank you for the suggestions.  I can't say we will implement them, but it
is good to know what you would like to see.  Have you considered running a
Usenet service?  You might be good at it. 

> Most sites worried about privacy concerns will state one of the two
> following:
> 
> 1) the account is not abusing the net, or
> 2) the account is being dealt with according to the AUP.
> 
> Many persons are getting worrisome impressions regarding Altopia precisely
> because you are *not* responding to persons who are complaining, often about
> bona fide net.abuse.

We are aware that other sites react to abuse complaints in different ways. 
This is one of the things that gives each site a unique character.  We put
a FAQ up to address many of these issues and how we handle them.:

   http://www.altopia.com/polfaq.htm

Some of the answers in this FAQ explicitly state that we will ignore
certain complaints. 

> >  1) Your definition of abuse was vastly different than ours and so it
> >     appeared that it would have been futile for us to engage in a
> >     discussion with you. 
> 
> 1) According to your own Acceptable Use Policy, interfering with a Usenet
>    newsgroup (not merely trolling, but deliberately trying to interfere with
>    it's workings) is unacceptable.  I sent you repeated evidence of this.

I'd love to know which specific part of our AUP you are referring to.  We
disagreed with you that the posts were a denial-of-service or a flood and
so no action was taken with respect to that.

We did take action with respect to the poster's use of harvard.edu and to
our knowledge the poster complied with our request. 

> 2) According to your own AUP, much of the stuff such as path forgery was
>    likely a violation.

The items that we felt were attempts at forgery were handled by us.  In
terms of the Path: line it is difficult to discern whether a poster is
pre-loading to prevent posts from arriving at a particular site, or
whether they are forging to make posts look as if it came from a
particular site.

> 3) I'm going to be flat out and state that some of Altopia's policies--
>    not all, mind, but several of them--seem to be at variance with 
>    accepted standards of what is and is not abuse of Usenet.  Among
>    these are, apparently, that forgery of Approved: headers for posts
>    to moderated groups is accepted as tolerable at Altopia (this will
>    get you yanked from nearly EVERY other provider, and will also get
>    you *rapidly* banned from anon remailers) and that posting of binaries
>    to non-binary newsgroups (again, this *is* considered a form of net.
>    abuse) is also tolerated.  If you have problems with this, I suggest
>    strongly that you take it up with the readers of news.admin.net-abuse.
>    usenet--it's the admins of Usenet in general who decide what is and is
>    not net.abuse, not myself.

In our opinion, there is no such thing as accepted standards on Usenet. 
Each site decides what rules they want to have.  Each site also decides
which sites they want to alias out because of policies they don't want to
tolerate at the remote site.

This is one of the major things that separates Usenet II from Usenet.  As
I am sure you know, Usenet II has the concepts of soundness and czars. 
The way this is enforced is very effective. 

> >  2) When you started threatening legal action, we definitely were not
> >     going to respond, because after that point we have to treat things as
> >     if they will end up in court.  Correspondence at that point would have
> >     been pre-trial discovery and that would not be appropriate without the
> >     presence of our corporate attorney. 
> 
> I was noting that legal action was a definite possibility to inform you of
> the seriousness of what your users were doing, Chris.  And it would not be
> your lawyer getting involved with *me* if it'd gotten to that point--it
> would be your lawyer discussing things with law enforcement.
> 
> I pointed out to you, repeatedly, that the posts were not only an attempted
> denial of service attack, they were also meant as harassment *and* they
> furthermore often contained heavily forged headers designed to implicate
> innocent sites.  The parties involved in this *have* done this before, 
> for what it's worth; this is a group of four or five individuals who have
> been doing this for upwards of a *year*.  So far, your site is the
> *solitary* one which has been uncooperative in stopping the abuse.
> 
> If you wish, I'll gladly provide logs and other info of some of their past
> attempts, most of them through open NNTP servers.
> 
> I, frankly, was hoping that I wouldn't HAVE to have the cops subpoena logs
> from your site.  My point in this was that this is a serious situation--
> serious enough that I am considering calling in the cops if necessary to get
> it stopped.  (There were other incidents, likely by the same parties, that
> pushed me to that point.  The first was that my fiance, who has not posted
> to Usenet in *months*, was listserv-bombed, possibly by the same person
> posting under the "meowbot" aliases; the second was that threats were being
> directed against a project I am in, and after the listserv-bombing of my
> fiance I seriously considered disinvolving myself from the project so that
> the rest of the members could avoid harassment.)

As our FAQ concerning harassment says, we encourage those who feel they
are being harassed to contact the appropriate law enforcement agency.  We
would prefer that you don't contact us concerning harassment because we
have no way of determining whether harassment is taking place.  That is
something for a court of law to determine and we do not want to raise our
liability by becoming involved. 

We have cooperated with law enforcement in the past and will continue to
do so in the future.  If the harassment against you is continuing from
customers of Altopia, I encourage you to contact law enforcement.  I am
surprised that we have not yet heard from Kentucky law enforcement since
you said multiple times that you will be contacting them if we don't
respond by the deadlines you presented.  Your credibility is questioned
because you said you would contact them and we have not heard from them.

> >  3) It is difficult to take seriously correspondence from someone with the
> >     name "Follower of the Clawed Albino".  If this is your real name, I
> >     apologize but please try to understand our position. 
> 
> 1) FWIW, other sites have *happily* accepted posts and email from this
>    address and alias.  

That's irrelevant to us.  Our site chose not to.  The Internet is a big
space and to expect all sites to react similarly is not reasonable. 

> 2) If you had any questions, you could have *easily* asked me and I would
>    have provided names of folks who can vouch for me.  (For starters,
>    Chris Lewis could have.)

We do not rely on people to vouch for other people.  Your credibility with
us is based solely on your own actions.  Others may have experienced a
completely different side of you that we were being presented with, and so
nothing would be gained by us conversing with them.

Fortunately, this goes both ways.  We are often communicating with people
that many others would say are horrible, but which in our own
communication with them seem perfectly fine.

Do you really want to be judged by what others think of you?  This only
works if you can choose who to judge you. 

> 3) It should not *matter* what the nym or name of the person is who is
>    reporting net.abuse from your site.  The important thing is that *a
>    potential net.abuse situation is occuring*.

>From the standpoint of handling the abuse, this is correct.

>From the standpoint of replying and conversing with the person, this is up
to us.  It takes time (I spent over an hour replying to this particular
message) to engage in a conversation or debate with someone and so we have
to choose who we engage in a wise manner.  Your email name and the other
aspects of your mail made it unwise for us to engage you.  I stand by this
decision. 

> 4) With the comment above, you have just indirectly shot any claims on
>    why Altopia should not add IP-tagging, etc. out of the water.  If
>    you distrust net.abuse complaints from me simply because of my nom
>    de plume (which I use, in part, to prevent harassment from spammers
>    when I make net.abuse complaints--I'm sure NANA* can enlighten you 
>    on reasons why folks might want to do this) why should anyone trust
>    ANYTHING from alt.net whatsoever?  At least I can be traced to a
>    mailable address; I CANNOT say the same for the persons making the
>    posts I have complained about.

I did not say we distrust complaints based on email name.  I said we did
not reply for that reason, among others.

Complaints, regardless of the source, make us aware of a potential
problem.  We then research the potential problem and make an assessment
based on our own policies as to whether it is a real problem.

> >  4) Once you started sending multiple messages per day, from our
> >     perspective you appeared to be unstable and irrational.  The tone of
> >     your phone calls reaffirmed this suspicion.  This may not be the
> >     case, but it seemed likely to us that you would take our responses and
> >     spread them around Usenet or in court, out of context. 
> 
> Well, the reason I was sending you multiple messages per day was that *three
> or four of your users were deliberately trying to flood newsgroups and at
> least one was deliberately forging paths to make it look as if it came from
> elsewhere*.  After two weeks of *no* response whatsoever, my mails may have
> sounded curt.  To be perfectly frank, I was beginning to consider seriously
> the possibility that alt.net might be outright rogue.
> 
> My phone calls, FWIW, were made after my fiance was listserv-bombed, and I
> think you can understand how I *might* be a bit concerned.  
> 
> Let me put it this way--*you* put up with an attempted newsgroup flood that
> is part of a series of them, that you know from *their own posts* is
> targeted at you, you complain to a site for two weeks to *please* give you
> logs so you can find out where it is coming from (and hopefully colloborate
> it with ten other logs you have, to see if they've moved to a new ISP), and
> then someone who likely is one of the very perps using your site decides to
> listserv-bomb my fiance for no reason whatsoever other than he *is* my
> fiance, and a net.kook who joined in the campaign posted this in a FAQ using
> his *old* email address, not the one he uses now and which has not appeared
> on Usenet in *months*.  This tends to shake one up.  A *lot*.

Frankly, if this was happening to me I would have filtered out each
instance of the user and ignored/deleted the instances I did see before I
was able to filter them out. 

If you really consider our site to be rogue, I recommend you ask your
provider to alias us out.  In your particular case, we have private
peering with Airnews so I don't know if they would alias us out, but it is
certainly worth a try if our posters are bothering you and you can't
figure out how to use a filter.

> > We did follow-up on your complaints when we felt the complaint was
> > justified.
> 
> I noticed that the flooding of AHWW from alt.net, as well as the initial
> morph of "mahmoud", seems to have stopped.  I thank you for this.

No need to thank me.  It seems the posters have decided to stop. 

> I *will* note that a new morph, who may or may not be the same as the
> "Mahmoud" poster, seems to be trying to stir up the same stuff again.  He's
> posting with a munged From: line pointing to afkmn.org:
> 
> <begin excerpt>
> 
> Path: news-f.iadfw.net!thereisnocabal!news.airnews.net!cabal10!newsfeed.
> direct.ca!logbridge.uoregon.edu!su-news-hub1.bbnplanet.com!news.bbnplanet.
> com!news.alt.net!usenet
> From: cupcake@afkmn.org (Cupcake The Cat)
> Newsgroups:
> news.admin.net-abuse.email,news.admin.net-abuse.misc,alt.fan.karl-malden.
> nose,news.admin.censorship,news.groups,alt.politics.democrat,soc.culture.jewish
> Subject: Re: CAUCE members demand censorship
> Date: Wed, 12 Nov 1997 04:31:34 GMT
> Organization: TUNA !
> Lines: 24
> Message-ID: <34693019.6227877@news.alt.net>
> References: <34662752.61E9@netcom.ca> <646em6$ihn$2@usenet48.supernews.com>
> <34684fb2$1$fuzhry$mr2ice@news1.mnsinc.com>
> <64a3dj$sld$2@usenet85.supernews.com> <64adm7$ag1@garcia.efn.org>
> <64aqp1$kap$2@usenet76.supernews.com>
> X-Newsreader: Forte Free Agent 1.1/32.230
> Xref: news-f.iadfw.net news.admin.net-abuse.email:120707
> news.admin.net-abuse.misc:192530 alt.fan.karl-malden.nose:128472
> news.admin.censorship:49934 news.groups:329561 soc.culture.jewish:409343
>  
> On 11 Nov 1997 23:46:41 GMT, ricardo@primus.paranoia.com (Ricardo Hector
> Gonzales) wrote:
>  
> >Gary Frazier (gfrazier@efn.org) wrote:
> >: 
> >: Shut up, Rickie.  No one gave you permission to speak.
> >: -- 
> >:                                                Gary
> >: http://www.efn.org/~gfrazier
> >: Fight Spam!  Join CAUCE!  http://www.cauce.org
> >               ^^^^^^^^^^^
> >
> >Thanks for representing the censorship motivation of your organization.
> >People have been saying for a long time that CAUCE is only interested
> >in censoring individuals and your post is proof of that.
>  
> CAUCE has no use for JEW SPAMMERS like you, Ricardo.  If only
> the Spanish were more efficient during the Inquisition so that your
> ancestors did not escape to Mexico, the net would be a better place.
>  
> <end excerpt>
> 
> Now, this isn't to the point of bona fide net.abuse yet.  He's not flooding,
> he's not doing sillybuggers with the Path.  I don't know what exactly you
> did re the "Mahmoud" poster, but if he got booted he MIGHT have gotten back
> on (I don't know, honestly, if you blacklist folks you boot).  I won't ask
> you to nuke this one--yet.

The post above does not violate any of our policies.

> I really *would* have liked to known where some of the AHWW floodposts were
> coming from (that were through alt.net).  In particular, I'm still half
> curious if some of 'em came through Springfield, MO POPs (during the last
> major waves of this, the major culprit was someone using a Springfield, MO
> POP of Smartnet) of ISPs, or if any came from Carnegie Library (someone's
> been using open NNTP servers to binary-bomb the same groups being hit by the
> "naughty noser" problems).  

If this stuff happens again and you want to know where it is coming from,
either have law enforcement subpoena the information or have your attorney
subpoena the information.  The United States system of government has
checks and balances in it for a reason. 

Also, feel free to email us the Message-IDs you want us to save away as
potential evidence and we will do so if you explicitly ask this.  We may
not reply to your request, but the archiving will likely be done. 

> I'd be happy, though, even with a note that "this is being dealt with".
> That and being able to know where abusers are coming from--even if you boot
> them off, they will often move to another provider or to open NNTP servers
> until the "home" account is cut off.  (This is another reason it's kind of
> important to determine whom is posting from alt.net, if you're not intending
> to go full whole hog with the anonymous posting service.)

If we tell you where users are coming from, not only do we violate their
privacy, but we also put ourselves in a position of increased liability
because users have an expectation that we will not share this information. 

Chris Caputo
President, Altopia Corporation


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850

iQCVAwUBNG/mBz0Jz30h6bOhAQEVGwP/VFTIN5IHWKR1XCPDM0/XZ2tLpI/67jLX
2ipj9C5zab9BC3kiB+BdhEq7n1nJuZSu1XGcodL/+x2irNVbuwvON6CPbSkZM0Pk
HT1UKnn85OwGdox0bOo3E86S6leEPxRpQjrqXoLTCypfIGaMNMbg2/t2EzAJ3112
DvNCg6axCeY=
=T9l4
-----END PGP SIGNATURE-----