TechTheft

Building a DNSBL

NANAE have a saying: "The legal advice you can get from a non-lawyer is worth, at most, what you pay for it."

That said, there has been a LOT of theorizing about the legal aspects of such blacklists and a few lawsuits and no court decisions on the merits of any of those cases, with the possible exception of one special one.

Keep in mind that for all the bluster by spammers and other listees about how awful it is to block mail, the question of whether or not anyone blocks mail is probably of very little legal import. There is no basic right to email delivery, and while recipients who pay for having mail delivered to them have a reasonable expectation that their provider do so, that is an expectation which is paid for and is sculpted by whatever contract they have agreed to with their provider. Most standard contracts for email service are explicit about disclaiming any guarantees of any particular level of service. Many providers offer users an option of filtering or no filtering and clearly warn the users that filtering can catch non-spam email, a risk that users have to explicitly accept.

There isn't much risk in defamatory lies about opponents who can't afford a lawsuit or who aren't particularly litigious. Unfortunately, a blocklist will meet such opponents if it wants to be effective. Even IP addresses which are listed exactly according to the published criteria can be in use by a wealthy, litigious spammer or company.

That said, the fact that a lawsuit cannot be won on its merits says nothing about the ability and willingness of a motivated party to file it and make it very costly. The obvious recent example is the EMarketers America suit against various people connected to or accused of being connected to Spamhaus and SPEWS. That case was in fact a lesser example: the cases against MAPS cost MAPS something approaching 8 figures, and none was ever decided. MAPS was effectively crushed by those suits.

When that happens, it helps if the listings are 100% according to the publicly published criteria.

Free-Speech

BLOCKLISTS ARE NOT PROTECTED BY "FREE SPEECH OPINIONS." This is urban legend. A blocklist is a content provider.and must have a good faith basis for opinion AND employ "ordinary care." This concept was seemingly affirmed in Joe Jared (Osirusoft) vs Pallorium.

see What Is Free Speech?

In practice the list has the same obligations under free speech as a public notiary. To prove that the information is valid, correct, accurate, true and verifiable for as long as it is on the list. And that the intent and purposes of the list are publicly made clear.

Location

In practice, only in the USA (MAPS) and New Zealand (ORBS) blocklists have been sued with any positive results for the spammers and even there, the spammers only had success because they were willing to drain the defendants' resources. China does have at least one blocklist and while it may be even more conservative than MAPS it hasn't been sued.

Many countries (even the USA) don't give commercial speech the same level of protection as other speech. As far as I understand, a list of senders of UBCE would have *far* better protection in Cuba than in the USA. SPEWS had a reason to choose Irkutsk (one couldn't be deported to Siberia when one *was* in Siberia; expecting snivelling obediance in Siberia might be the reason why corporate serfs envy SPEWS so much).

In practice: don't host a DNSBL in a country where "common law" gives SLAPP's too much chance; know the law well enough like Steve Linford; or bend over to large corporations like MAPS.

Case: ORBS

The one oddball case is a telling example as well. ORBS presented itself as listing open relays and sites that refused to allow relay testing. At one point it listed IP addresses of major ISP mail servers which were not open relays and were testable without showing any signs of relaying. ORBS (operated by Alan Brown) knew this, yet continued to list those addresses. As it turned out, the listees were commercial creditors of Brown's business. This progressed to a lawsuit, and eventually to Brown fleeing the jurisdiction of the NZ legal system to avoid the consequences of his behavior. It is my understanding (as a non-lawyer and certainly no expert in NZ law) that formally that case is considered decided by default, although it may be that this status is revocable if Brown decided to return to fight it (as it would be in some circumstances under US law) but that seems unlikely. At any rate, this is a special and important case because it seems to be a very clear cut case of actual libel in a DNSBL: ORBS claimed that a particular DNS lookup result meant that an IP address was an open relay, but in this case ORBS was returning that result for machines which Alan Brown knew were not open relays. ORBS also listed addresses on other criteria using other response addresses, so it was pretty clear that the content of ORBS' speech was not 'Alan Brown dislikes the operators of these addresses' or 'the operators of these addresses have bad billing practices' but 'these addresses are open relays' which was a clear and defamatory falsehood. There are a few things that any blacklist operator needs to avoid to keep out of justifiable and proper lawsuits, and telling lies in the blacklist is the most important because telling lies that you expect others to use to the detriment of the lied-about party is certainly libel and in some places may even be criminal.