[anti-abuse-wg] Spam under protection. Believe it or not!

In message <DE5625ACFDDA45B4B1BDEA8B90AF1859 at SuperPC>, 
"Marilson" <marilson.mapa at gmail.com> wrote:

>But the PRIVACYPROTECT.ORG is providing privacy protection services to =
>this domain name to protect the owner from spam and phishing attacks. =
>Unbelievable!!! The owner is a fckng damn spammer...

I don't know why you are surprised.  This happens all of the time.  Most
spammers these days have most of their domains registered with "privacy
protection" type services.  It has become common practice.  In fact, the
various registrars who offer this dubious service knowingly make lots
of money from spammers.  You could complain about that to ICANN, if you
wanted to, but you would be wasting your time.  It would be like complaining
to the U.S. Federal Reserve about the behavior of U.S. banks.  Here is a
hint... The U.S. federal Reserve *is* the banks.  Likewise, ICANN *is*
the domain registrars.  Thus, ICANN will never lift a finger to either
stop or even regulate something like this... a "feature" which makes
their members LOTS of money.  (Several years ago, ICANN itself gave
approval for exactly this category of criminal-protection service.)

>According to the rules, PrivacyProtect.org is not responsible for any of =
>the activities associated with this domain name.

That is absolutely NOT correct.

In the United States, at least, the legal rules are 100% clear.  If someone
using a given domain name is doing something which is either criminal or
civilly actionable (as in a private lawsuit) and if the domain name is
registered by one of these privacy protection services, and if that service
is informed of the issue, and if they then do nothing within a reasonably
short period of time (e.g. a few days) then any legal responsibility that
belonged to the registrant of the domain name is effectively transferred
to the owner/operator of the relevant privacy protection service.

Thus, if spamming is illegal (i.e. either criminal or actionable) where
you are located, and if the registrant of a given domain is spamming
you, in violation of law, and if you inform/notify the operator of the
relevant privacy protection service that this is happening, and if they
they do not reveal the true identity of the party who is the real registrant
of teh domain name(s) in question, then you may be able to sue them AS IF
they were the spammer himself.

I know a guy who has actually done exactly this... multiple times, i.e.
sued the operators of the privacy protection services (which are generally
also domain registrars).

Why did he do this?  Because it is quite typical for these registrars to
go out of their way to protect the identities of their criminal customers.
(They like the money they get from spammers and other Internet miscreants.)
In most cases, if you notify them of what is happening, they will do
absolutely noting, and normally, they often do not even respond.

In at least a few cases, their anti-social stubborn intransigence and
their protection of their criminal customers HAS caused them to be sued
for their responsibility for the bad actions of their customers.

I seem to recall that this is even part of the standard ICANN registrar
agreement.  If the registrar offers a "front man" or "cut out" registrant
anonymity service, then they agree that THEY will be legally responsible 
if they are informed of the issue and if they do nothing.... which is
exactly what they usually do.


Regards,
rfg