“Welcome to the death of email, ladies and gentlemen. Would the last person to leave email please turn out the lights?”

That’s how a spam fighter greeted the Nanae crowd on the evening of November 22, 2003. Earlier that day, the U.S. House of Representatives had overwhelmingly approved the “Controlling the Assault of Non-Solicited Pornography and Marketing Act,” otherwise known as CAN-SPAM. The measure was expected to sail through the Senate and be signed into law by President George W. Bush. After six years of failure, Washington was about to enact its first federal anti-spam legislation.

So why the dire prediction on Nanae? Many anti-spammers felt the proposed law was in fact legalizing junk email—and, in the process, opening the floodgates to spam.

“I said years ago that government would only screw it up,” wrote one spam fighter on Nanae. “Will those who have been calling for Congress to do something, please stand up and slap yourselves up side the head?”

CAN-SPAM had been hatched in April 2003 by Republican Senator Conrad Burns of Montana and Oregon Democrat Ron Wyden. Their Senate bill, S.R. 877, embraced an opt-out policy that put the burden on Internet users to unsubscribe from spammers’ lists. That was philosophically backward, according to the Coalition Against Unsolicited Commercial Email. CAUCE and other consumer groups believed that U.S. spam law should be based on an opt-in framework, with advertisers obligated to obtain permission from consumers before sending email solicitations.

But the Senate unanimously passed S.R. 877 in October 2003, thanks in large part to support from the Direct Marketing Association and several large ISPs, including America Online and Microsoft. (Many anti-spammers speculated that the ISPs hoped CAN-SPAM would enable them to more easily sell access to their subscribers by mainstream marketers, otherwise known to spam opponents as “mainsleaze.”) After being sent to the House of Representatives, the measure gained a few amendments and was approved by the House 392–5 that November, leading one Nanae participant, only half in jest, to call for the blacklisting of Congress’s networks.

“I say, add SBL/Spews listings for the U.S. House and Senate servers, for ’spam support,’” wrote the frustrated anti-spammer.

The passage of CAN-SPAM caught many anti-spammers by surprise, but not Spamhaus leader Steve Linford. He’d been monitoring the bill’s progress for months and considered it abysmal compared to spam laws recently passed by Australia and some European countries. (In December 2003, a new opt-in spam law in the United Kingdom would go into effect, prohibiting marketers from sending email ads to consumers who hadn’t requested to receive them.)^[1]

But when Linford jumped into the Nanae discussion of CAN-SPAM, he noted the bright spots in the proposed U.S. law. For one thing, he said, law enforcement officials would appreciate CAN-SPAM’s criminal provisions. Linford pointed out that CAN-SPAM would outlaw the use of spam “zombies” and proxy servers.

“Obviously it’s not going to happen overnight, but fairly quickly in 2004 I would expect that ... spammers will either emigrate to China, or do jail time for proxy spamming,” said Linford. Without legal access to proxies, he argued, spammers would be flushed out into the open and forced to send their emails from their own networks. That would make them susceptible to blacklists such as the SBL.

Other strong points in CAN-SPAM included a ban on collecting email addresses online using automated harvesting tools. It also prohibited forging message headers, and it required spammers to include a valid “From” address. The proposed law further specified that spammers list a valid physical mailing address in their messages, as well as include a working opt-out mechanism, such as a link to a web page for easy unsubscribing.

But opponents of CAN-SPAM found other aspects of the legislation troubling. Language in the bill empowered the Federal Trade Commission to create a Do Not Email list, patterned after the recently implemented federal Do Not Call list. But Congress had not required the FTC to create such an email registry. Without it, the onus would be on consumers to unsubscribe individually from potentially hundreds of spammers’ mailing lists—even though many Internet users had been taught that opt-out links were usually a fraud designed to harvest verified email addresses. (There had even been recent reports on Nanae that some spammers were using fake opt-out links in an attempt to install Trojan horse software on the computers of unprotected Internet users.)

Also objectionable to many spam fighters was CAN-SPAM’s lack of a “private right of action” clause. The law would give the FTC, state attorneys general, and ISPs the ability to sue spammers who violated CAN-SPAM. But individual spam victims would be denied such recourse. As a result, CAUCE predicted that enforcement of CAN-SPAM would be rare and infrequent. The anti-spam group said regulators and attorneys for ISPs lacked the time and resources to pursue more than a few symbolic legal actions against spammers.

“Unless the FTC is given a massive appropriation to pay for more prosecutors and investigators, giving consumers a right to sue is the only way to get enforcement at a frequency to make spammers think twice,” said CAUCE in an October 2003 statement at its web site.

Particularly aggravating for many spam opponents was language in CAN-SPAM dictating that the new federal law trumped several states’ stronger junk email laws. Among the state spam laws preempted by CAN-SPAM was a strict opt-in spam law in California that would have taken effect on January 1, 2004. The measure would have allowed individuals to sue spammers for up to $1,000 per unwanted email message. Not surprisingly, many bulk emailers were relieved to see the California law gutted by CAN-SPAM.

“We are very excited,” OptInRealBig.com CEO Scott Richter told the New York Times on the day the U.S. House passed CAN-SPAM. “All of our clients had been worried about the California law. In the last two hours we have been booking a lot of orders for January.”^[2]

Despite CAN-SPAM’s critics, Congress and the White House moved ahead quickly to make it the law of the land. On December 16, 2003, Bush signed the landmark bill. The President had no official comment on the Act, but cosponsor Wyden released a statement, saying that the new law created harsh consequences for “kingpin” spammers.

“Swift and aggressive enforcement will be essential,” said Wyden. “I will continue to push the Federal Trade Commission and others to use the tools this law gives them to fight against spam.”

With little time to prepare before CAN-SPAM went into effect January 1, 2004, email marketers of all sorts struggled to come to grips with the complex law’s requirements. Some in the junk email business worried that federal and state authorities would begin aggressively pursuing spammers in the new year. Attendance at an early-January 2004 Las Vegas trade show for email marketers was reportedly down, because many spammers feared law enforcement officials would use the event to make CAN-SPAM arrests. (They didn’t.) Meanwhile, some law firms created new practices dedicated to advising e-marketers on how to comply with the federal anti-spam law.

Shiksaa was delighted to see spammers fretting over CAN-SPAM. One evening in late December, she teased Nevada bulk emailer Bill Waggoner over AIM.

“Getting nervous? Are you worried you’re going to jail or to court?” she asked.

“No, of course not,” replied Waggoner. “Jesus loves me.”

“Keep spamming, and maybe you will get sued too. One can hope,” she said.

Shiksaa was especially pleased to learn that CAN-SPAM preserved Internet service providers’ right to block any messages they deemed unwelcome—even if the spam was in full compliance with the new law.

“There is nothing you can do to force them to accept it,” she called out to spammers in a message on Nanae. “Want to sue? Go ahead and waste your money, boys. It’s becoming very expensive to run a spam shop.”

Online support groups for spammers were abuzz with discussions of how to avoid trouble under the new law. After members of the Send-Safe forum held a December conference call with an attorney to discuss CAN-SPAM compliance, some junk emailers contemplated pulling out of the business.

“I am sure many of you are as worried as I am. I am really unsure what to do. I am considering shutting down my offices and/or scaling way back,” wrote one Send-Safe customer, who said she primarily sent spams on behalf of insurance companies.

But other veteran spammers vowed that CAN-SPAM wouldn’t mean the end of spamming.

“Sure, it is tougher and the cards are stacked against us, but WE ALWAYS PULL THROUGH. This time will be no different. WE WILL GET COMPLIANT AND continue to mail for sure. That is our way,” said a Send-Safe employee. Indeed, Send-Safe soon released a new “CAN-SPAM compliant” version of its program that used rented email servers in China, rather than proxies, to anonymously send messages. Other spamware vendors released similar products.

Meanwhile, entrepreneurs began developing other offerings aimed at spammers worried about the law. New services sprang up selling “valid froms”—batches of working email addresses that could be used in the “From” line of spams, as required under the law. Operators of the services manually created accounts at free email providers all over the world and resold those accounts to spammers.

“You could easily spend more time signing up valid froms than you spend mailing. You will also drive yourself nuts doing this tedious and boring job,” stated one ad for a valid-from service that charged spammers twenty-five dollars per month for fifty valid from addresses.

Several U.S. companies also launched services offering to set up offshore incorporations and merchant accounts for spammers. The web site of one such service promised that incorporating in the Bahamas could shield businesses from the “litigation explosion” in the U.S. and could “protect their savings, investments and other accumulated assets that may be attractive targets for hungry trial lawyers.”^[3]

But many spammers seemed unperturbed by the new U.S. spam law. In the SpecialHam.com forum, a spammer using the alias “nukeananti” said CAN-SPAM wouldn’t change his business practices.

“Honestly, I don’t think this law will be easy to enforce, and it will only result in a small reduction in spam. Already many states have laws against spam, and many of them are more restrictive. They don’t have the resources to police email, and I doubt taxpayers would want the FTC spending millions of dollars on this,” wrote the spammer.

Bottom line, said Nukeananti, “I am going to keep on mailing.”

Buried within the dense language of the CAN-SPAM Act was an unusual enforcement provision overlooked by many people. Under the new law, the FTC was required to consider a bounty system for those who tracked down illegal spammers. The authors of CAN-SPAM proposed rewards of “not less than 20 percent of the total civil penalty collected” by the FTC. Lawmakers gave the agency until September 2004 to report back on the plan’s feasibility.

The idea of paying monetary rewards to anti-spammers was spawned in September 2002 by Lawrence Lessig, an Internet visionary and professor at Stanford Law School. In an op-ed piece, Lessig suggested that spam would abate if the government required spammers to tag their messages as such and forced spammers who don’t label their junk email to pay $10,000 to the first recipient who finds them.

“If we deputized the tens of thousands of qualified people out there who are able to hunt offenders, then a large number of offenders would be identified and caught,” he wrote.

Lessig believed so strongly in the concept that he staked his job on it. In January 2003, he publicly stated that he would resign his position at Stanford if a spam-bounty system became federal law and did not substantially reduce the level of spam.

Lessig’s stunt worked. Lawmakers slipped the bounty provision into CAN-SPAM at the eleventh hour. With the passage of the bill, capturing a spammer’s hide had become a potentially lucrative pastime. Yet few anti-spammers rejoiced at the opportunity. Steve Linford pointed out to journalists that Spamhaus and other organizations already had plenty of information about spammers. The problem, he said, was getting prosecutors to act on it.

Shiksaa didn’t give much thought to the prospect of a career as a spam bounty hunter. She had never been driven by financial motives. Instead, she believed that her online activism would be its own reward. Yet as Shiksaa entered her fifth year of spam fighting in 2004, she resolved it would be her last.

Shiksaa would never admit it to the spammers, but the events of the past nine months made it clear she was locked in a losing battle. For all her efforts, the spam problem was getting worse, and it was messing up her life in the process. Back when she was getting started, Shiksaa had thought spammers were simply misguided people who would respond to reason. Put a few on the right path, and the tide of spam would ebb. She knew better now. Spam had become organized online crime. The spammers operated in little cartels, with their private spammer forums and closed mailing lists. They knew what they were doing was unethical, but they were too arrogant and antisocial to care.

And some, like Richter, were also savvy enough to give CAN-SPAM—and maybe even the New York and Microsoft lawsuits—the slip. In essence, CAN-SPAM was a truth-in-sending law; it removed spammers’ ability to lie about who sent their email. As such, it would create few problems for Richter, who relied much less on anonymity than other spam kings. As Shiksaa saw it, Richter’s business was built around a simple premise. Millions of people on his lists were too busy or too computer illiterate to unsubscribe from—let alone complain about—spam. Richter had built his wealth on the small percentage of people gullible enough to buy whatever junk he was offering.

Shiksaa certainly didn’t owe Scott Richter any favors. But in January 2004, Richter’s dad asked her whether she’d sign an affidavit regarding Dustin Parker, the young computer expert who had deserted OptInRealBig.com LLC. Steve Richter wanted her to testify in writing that Parker had provided her with proprietary company information. He said it was necessary to his son’s lawsuit against the former employees.

Shiksaa replied that Parker had merely given her instant-message logs. But she agreed to sign an affidavit to that effect.

“I’m not doing this for him or for you,” she told Steve Richter. “I’m doing it because it’s the right thing to do.”^[4]

As the year 2004 unfolded, Shiksaa kept a much lower profile. She avoided heated confrontations with Richter and other spammers over AIM. She couldn’t give up on Nanae altogether, but she went long stretches in “lurk-only” mode, reading but not contributing to the discussion. She continued to hang out on #Lart, the Internet relay chat channel popular with her close anti-spam associates. But spam was no longer a crusade. She had certainly lost the desire to poke spammers with a sharp stick just to see how they’d react.

To that end, Shiksaa removed almost all of the files from Chickenboner.com. She took down pages displaying the various photos parodying Andrew Brunner, Bubba Catts, Rodona Garst, Davis Hawke, Bill Waggoner, and others. Shiksaa also removed the “Bulk Barn Diaries”—her log files of conversations with Richter, Dr. Fatburn, and other spammers. She had begun cleaning house back in the spring of 2003, after Mark Felstein sued her and the rest of the Nanae Nine. But now the site was totally spartan.

About the only thing Shiksaa left on her site was the big “Uncle Sam” cartoon on the home page. Like the World War I recruiting poster, the image at Chickenboner.com showed a gray-haired man dressed in red, white, and blue, pointing at the viewer. But an anti-spammer had doctored the image to give the personification of the U.S. government a wooden mallet in his hand. Beneath Uncle Sam were the words, “The Lumber Cartel Wants You.”

Davis Hawke spent Christmas Day 2003 at his parents’ home in Medfield, Massachusetts. He and Patricia drove up from Rhode Island in his Crown Victoria with their two wolves in the backseat. (Hawke had brought Patricia along on an invitation from his mother.) He was antsy from the moment he pulled into the Greenbaums’ long driveway.

Hawke had intermittently been in touch with his father since dropping out of college. But he had only recently mended ways with his mother. They had tacitly agreed not to talk about his neo-Nazi period. But she made it clear she didn’t approve of his spamming either. The thought of spending several hours in her home filled him with dread.

To break the ice, Hawke presented his mother with a gag gift soon after he arrived. It was one of the Truster portable lie detectors he had been spamming for a couple months. He explained that the handheld unit worked by measuring the stress levels in a person’s voice. Israel’s Mossad security service, he told her, used a similar device to interrogate suspected terrorists. Peggy Greenbaum didn’t even take the Truster out of its box. But he could tell she was pleased to learn he wasn’t just selling penis-enlargement pills.^[5]

After lunch, they all took the dogs (his parents had a Husky mix) for a stroll through the woods to a nearby pond. It was unusually mild for December, with temperatures in the fifties. As they scuffed across the remnants of snow on the ground, Hawke’s mother posed a question.

“Britt, you say you have such a huge business, but why aren’t you on the list of the top spammers?” she asked. Mrs. Greenbaum had recently done an Internet search and found the Spamhaus Rokso page. Aside from Patricia’s mink coat, she saw little evidence that her son was as wealthy as he claimed.

“Ah, but that’s the mark of my success,” Hawke replied, not certain whether she was criticizing or just teasing. He explained that getting blacklisted on Rokso made life very difficult. He said his strategy was to keep a low profile and quietly get rich without attracting attention.

Then Hawke told his parents about how he and Bournival were about to launch a major new project. In the coming weeks, he said, they planned to interview several hundred people up in New Hampshire and build a new customer service center. He couldn’t tell them much, except to say it would make millions of dollars.

“They’re going to want to interview me on Larry King Live,” said Hawke. But just to be safe, he told his parents, he would continue to rent rather than buy a house, and he would drive second-hand cars.

“You can’t own assets in this business,” Hawke said.

That was just fine with the Greenbaums. They would have preferred if their son were a doctor or a lawyer. But their moral objections to his choice of career were softened by his pragmatic approach to the business. In any case, they considered spamming a lot better than what he had been doing previously.

When everyone returned from the walk, Hawke told his parents he needed to head out. He said he wanted to get up to New Hampshire right away, so that he and Bournival could begin what would probably be a two-week process of launching the new operation. It disappointed the Greenbaums to see their son leave so soon, but they were happy he seemed so energized by his work. He promised to send them updates by email.

A few days later, Hawke pulled up with a rental truck at the loading dock outside Amazing Internet Products’s office in Manchester. He wasn’t there to unload telephone headsets or chairs or desks for the hundred new employees he’d told his parents about. Hawke was just claiming his half of the company’s forty-plus computers and inventory of pills.

Hawke didn’t want to upset his parents at Christmas by revealing that his new project had actually stalled out a few weeks previously, when he and Bournival decided to dissolve their partnership.

The big plan would have involved sending a new form of spam aimed at mobile phones. Hawke and Bournival had discovered that most major cellular-phone providers in the United States operated Internet gateways for forwarding email to subscribers’ phones. Few cellular customers in the U.S. used the feature, known as short message service (SMS). But all the carriers had nonetheless set up millions of email addresses with subscribers’ ten-digit cell phone numbers as their account name (e.g., [email protected]).

At first, both Hawke and Bournival saw an excellent opportunity to target the cell-phone gateways with automated spam attacks. They could configure their spam programs to latch onto a provider’s domain and pepper it with area codes, prefixes, and number combinations that might be valid for the particular provider. (To spam Sprint PCS in Dallas, for example, they’d start with [email protected], and then hit 2144170001, and incrementally work their way through all the possible phone numbers.)

While SMS spamming was common in Europe and Asia, Hawke believed the U.S. market was still waiting to be pillaged. Very few U.S. spammers knew how to mass-broadcast SMS messages. At the same time, he figured most cell phone carriers in the country had poor safeguards to prevent spamming compared to regular ISPs. Even better, as far as Hawke could tell, the CAN-SPAM laws did not apply to cell phones.

But Bournival came to doubt whether SMS spams would actually produce sales. The technology limited messages to a scant 160 characters. Besides, they couldn’t contain clickable hyperlinks, so the spams would need to include a toll-free number or a web site address. Bournival argued that most recipients would be annoyed by the spams, and those who weren’t would be too lazy to seek more information.

At the time, Bournival had generally lost patience with Hawke as a partner. Hawke’s impulsiveness and sloppiness grated on him. Plus, their 50/50 revenue split seemed unfair given how much more work Bournival was doing. (Having access to Hawke’s unlimited merchant account seemed irrelevant when business fell off the previous autumn and they were taking in only a few thousand dollars a month.) After agreeing they could each make more money spamming solo, the two decided to divvy up their computer equipment and inventories and go their separate ways.

Hawke and Bournival stayed in regular contact. But while Bournival started 2004 without any major New Year’s business resolutions, Hawke was busy setting up an office to house his new firm, the Phoenix Company. He arranged to rent the top floor of a three-story office building on Main Street in Pawtucket, overlooking the Seekonk River. The office occupied over 5,000 square feet in the modern, brick building. Hawke’s new crew consisted of Mauricio Ruiz, Mike Clark as technical guru and spamming affiliate, and Jacob Brown—a young guy he met on the Pawtucket tennis courts who had previously been working as a waiter—as office manager. Hawke also hired several young women—most of them friends of Mauricio’s—to handle customer service. At one point, Hawke transferred the registrations of hundreds of Amazing Internet Products domains to the Phoenix Company and listed Ruiz as the owner of the domains.

The Phoenix Company started off spamming some of Hawke’s old standbys: the Truster lie detector, the Banned CD, and Pinacle penis pills. Then, in late January, when Hawke heard the FDA had announced a ban on ephedra sales effective April 12, he cooked up an idea for a new spam campaign. Hawke arranged with Certified Natural to private-label ephedra pills under the RaveX brand. The name was a reference to “raves”—high energy, all-night dance parties that feature loud techno music and often involve drugs such as Ecstasy and methamphetamines.

Hawke’s RaveX web sites, designed by Certified, featured a pink-and-black illustration of a young woman dancing wildly. Beside her in white type were the words, “Pure Ephedra. Buy It While It’s Legal.” Despite reports of several deaths linked to ephedra, Hawke’s spams touted RaveX as an “all-natural stimulant” and claimed it was safe.

“Over-the-counter medicines such as aspirin and Nyquil are far more dangerous than RaveX,” said Hawke’s spams.

To increase his odds of getting his spams into AOL, Hawke switched to a new program called Dark Mailer. Developed by Russian programmers, Dark Mailer was pricey, selling for around $500. But the program gave spammers unprecedented power to manipulate their email message headers, even though doing so was illegal under CAN-SPAM. Through trial-and-error testing, Hawke quickly discovered ways to tweak his spam and penetrate most ISP filters, including AOL’s, pretty much at will.

Meanwhile, Bournival was trying to comply with CAN-SPAM just enough to stay out of legal trouble. He began using valid “From” addresses in all of his spams and always included instructions on how recipients could opt out of future mailings. But Bournival was reluctant to list his mailing address in the spams, as required by the new law. And he still relied on Super Mailer, which illegally used proxies, to send his messages. In order to further differentiate his mailings from Hawke’s—who was paying no attention to CAN-SPAM—Bournival arranged with Certified Natural to provide him a new, private-label brand of penis pills. Soon, he was spamming emails for Sizer XXX.

Bournival did pretty well without Hawke or his merchant account, although he certainly was at no risk of maxing out his $25,000 processing limit. Nor was he making enough to consider an offer he got from Alan “Dr. Fatburn" Moore to take over his order processing. Fatburn had been repeatedly pestering Bournival by phone and instant message to outsource the function to him for a flat fee per order. Bournival figured Fatburn was just hungry for cash now that he had been sued out of the spamming business. But something about the offer made him suspicious. Bournival wondered whether Fatburn was simply trying to lure him into a trap, as part of the settlement agreement he had signed with AOL in December.^[6]

Come February, the Phoenix Company’s profitable spamming run temporarily hit the skids. As was its habit, AOL had fine-tuned its spam filters, and suddenly RaveX spams were not getting through. Ruiz and Clark went back to the drawing board, in hope of tweaking the messages so they would slip by. But Hawke decided it was a perfect time for him and Brown to dust off the abandoned cell-phone spamming project.

The first task was to create mailing lists. The two men scoured the Internet to find information about the various six-digit area code and prefix combinations in use by cell phone carriers. They could find nothing comprehensive, so they began manually compiling lists based on cell phone numbers of friends and relatives. Then they moved on to extrapolating from cell phone numbers they found published on the Web.

Next, Hawke and Brown sent test spams to Brown’s Verizon Wireless cell phone and Hawke’s Sprint PCS phone. They were surprised to discover the carriers apparently had rudimentary filters in place. After some experimentation with the content and headers of the messages, they were able to get most of their spams through.

At that point, late February 2004, Hawke and Brown began pounding out millions of RaveX ads to Verizon Wireless and Sprint PCS addresses.

To stay under the SMS message limit, Hawke included just a subject line (“Banned in 30 days?”) and a short message body (“Get EPHEDRINE now! Guaranteed to work or your money back!”). The messages also listed one of the several toll-free numbers Hawke had set up. Spam recipients who called the number heard a sixty-second advertisement recorded by one of Hawke’s female employees. Listeners who lasted until the end of the recording were instructed to press 2 on their phone keypad to place an order, or press 1 to unsubscribe.

Cell phone customers, it turned out, were even more hostile toward spam than email users. Irate recipients phoned the Phoenix Company’s toll-free line and vented at the handful of people Hawke had hired to handle calls. Others jammed the voice mail system with angry messages. Hawke managed to take in only a couple dozen orders before the phone company shut down the toll-free line. In the first week of March 2004, local papers in Oklahoma and North Carolina ran articles about residents who had been roused from sleep by their beeping cell phones, only to find messages advertising ephedra.

The plan that had looked so good to Hawke on paper proved to be a disaster. But Hawke wasn’t ready to give up on SMS spamming just yet.

Brad Bournival’s ringing cell phone woke him on March 10. It was eight in the morning; he’d hit the hay at around five a.m., his usual bedtime. Bournival’s half-brother, Erik Francoeur, was on the line. He told Bournival that someone had just been at the apartment on Montgomery Street and was trying to serve Bournival with a lawsuit. The man was waving a photo taken from Bournival’s Yahoo! member profile, which showed him, unshaven, wearing a cowboy hat and sunglasses. The man wanted to know if anyone had seen Bournival.^[7]

“What did you tell him?” asked a groggy Bournival.

“The usual drill,” said Francoeur. Bournival had instructed his family members to play dumb with anyone who came looking for him.

Bournival thanked Francoeur and hung up. He assumed the visitor was just another schmuck trying to get settlement money out of him. Bournival went back to sleep.

Bournival awoke again early that evening. As he was checking his email and reading the headlines at Yahoo! News, Bournival spotted an article about spam lawsuits filed that day by AOL, Earthlink, Yahoo!, and Microsoft. Bournival leaned in.

According to the story, the lawsuits were the first by ISPs under the new CAN-SPAM law. AOL’s lawsuit targeted Davis W. Hawke, Braden Bournival, and fifty unidentified “John Does.” The article quoted AOL’s general counsel, Randall Boe.

“If you’re a spammer, this is not a great day for you,” said Boe. “Ultimately, we’re going to locate you and sue you.”

Bournival stood up beside his desk, nearly overwhelmed with the fear that The Authorities were about to pound on his oversized front door. Then he forced himself to relax. He gazed back at the computer screen. Seeing his name among the top stories on Yahoo! was unreal. He had known for months—ever since Dr. Fatburn got sued—that this day might come. It was the risk he took every time he clicked the Send button. Yet he didn’t think AOL would choose him, not with so many bigger, more egregious spammers in the business.

But according to AOL, he and Hawke had generated over 100,000 complaints from members since January 1, 2004. The company had sicced its superstar outside counsel on him—Jon Praed, the same lawyer who sued Moore and Ralsky. AOL claimed Hawke, Bournival, and their affiliates falsified headers so that messages appeared to come from Hotmail or other ISPs. It said they had sent spam using dictionary attacks and address harvesting, which were prohibited under CAN-SPAM.

The law gave AOL the authority to seek damages of $100 per violation. What was that, twelve million dollars? Bournival looked around his high-ceilinged study, in the home that looked like a fraternity house minus the frat boys. How could he possibly survive this lawsuit?

Bournival reached for his cell phone. He was about to call Hawke, but he stopped. Instead, he dialed Dr. Fatburn’s number. He needed the name of Fatburn’s lawyer.

That evening, Mauricio Ruiz was over at Hawke’s house. He was surfing the Web on one computer while Hawke used another. Ruiz spotted the article first.^[8]

“Yo, Johnny, you are not fucking going to believe this!”

“Yo yo, what up,” Hawke replied. He pushed off from his desk and rolled his chair across the floor toward Ruiz.

“Look,” said Ruiz, jabbing his finger at the computer monitor.

The two of them stared at the screen, nearly cheek to cheek. Hawke impatiently scrolled through the article, waiting for the punch line. He was disappointed that the story buried his name in the tenth paragraph. But he began to laugh, a big, natural laugh.

“What is so funny?” Ruiz asked.

“How are they going to sue me?” Hawke said, his eyes flashing. “I have no assets.”

Then Hawke pointed to the bottom of the screen. The last paragraph of the article stated, “Hawke did not return a telephone call from The Associated Press to his home in Massachusetts.”

“Hell, they don’t even know where I fucking live!” he shouted.

Later that evening, when Bournival phoned him, Hawke was still laughing about the lawsuit.^[9]

“Congratulations,” Hawke told him.

Bournival wasn’t able to make light of the matter. He told Hawke that he was going to call a lawyer in the morning.

“Why? What can he possibly do for you?”

“I don’t know. I’ll find out my options,” said Bournival.

Hawke told Bournival to lighten up. He reminded Bournival that it was just a lawsuit, not a criminal case. It was nothing more than a huge corporation complaining that someone had unfairly taken its money. The police were not involved. It wasn’t about doing jail time.

But after he hung up, Hawke gave some thought to hiring his own lawyer. He knew just the guy to battle AOL. The previous December, spammers cheered when an attorney from Albo & Oblon convinced a federal court in Virginia to throw out an AOL lawsuit. AOL lost on a technicality; the judge said the court didn’t have jurisdiction over the case, which involved alleged spammers in Florida. And AOL later re-filed the lawsuit in a Florida court. But the attorney from Albo & Oblon vowed he’d get that case dismissed as well. That was the kind of chutzpa Hawke wanted in a lawyer.

There was no doubt that AOL had the advantage. Not even the best defense lawyer could dispute the evidence: Hawke, Bournival, and their affiliates had obviously sent the spams. The only thing open to debate was the damage they caused to AOL. As Hawke saw it, the case would probably end up the way spammer lawsuits always did. There’d be a settlement between his lawyer and AOL’s lawyers, whose goal was to take all his money, to “disgorge” his illegal profits, as they called it. AOL would also get a court injunction, saying he could never spam AOL again. AOL was just trying to make an example of him, to show the world that spamming AOL did not pay.

No way was Hawke going to give AOL that satisfaction. They could get Amazing Internet’s bank records from Bournival to calculate how much Hawke had made. But they’d have to bulldoze five states to put their hands on any of the money. He’d say he lost it all gambling at Foxwoods. He’d plead poverty, and they couldn’t prove otherwise.

In a way, being sued by AOL was liberating to Hawke. Now that the deterrent of a lawsuit was gone, he could spam with impunity. What was AOL going to do, sue him again? Hawke went to his computer and composed a brief ad:

In the “from” line of the spam, he listed his name as “Doctor Bulker.” He also provided a Yahoo! email address and one of the toll-free numbers he had set up for the Phoenix Company. Then Hawke blasted the spam out to a list of 80,000 addresses he had harvested from spam sites and other “bulk-friendly” sources.

The next day, Hawke kicked his spamming into high gear. He registered a couple of new domains, including ephedrazone.com, listing [email protected] as his email address. In hopes of recruiting new RaveX affiliates, he sprayed the Internet with want-ad spams:

Hawke’s spamming frenzy was short-lived, however. As word of the AOL lawsuit spread—the story made the front page of the New York Times — Spamhaus posted an entry about Hawke on the Rokso list, and his various Internet addresses were added to the Spamhaus Block List. Suddenly, many would-be customers couldn’t reach his web sites. To head off further problems, Hawke and his crew emptied the 150 Main Street office in the middle of the night. But Hawke’s troubles got worse a few days later when he received a call from his merchant-account contact. The deal was off. Hawke tried to negotiate, but the man just hung up and told Hawke never to call him again. Stuck without the ability to process credit card orders, Hawke scrambled to find a new merchant account. In the meantime, the Phoenix Company was relegated to accepting orders by check.

After retaining Dr. Fatburn’s lawyer from Whiteford, Preston & Taylor, Bournival decided not to play any games with AOL. He just wanted the legal process to run its course as quickly as possible. AOL’s attorneys served Bournival’s lawyer on March 17, and soon thereafter Bournival began a series of long telephone conversations with Jennifer Archie, the Latham & Watkins lawyer who teamed with Praed on AOL’s spam litigations. On his attorney’s advice, Bournival cooperated fully. He didn’t volunteer information, but he told Archie pretty much anything she wanted to know about Amazing Internet Products. To his surprise, instead of treating him like a criminal, she acted as if the lawsuit was just a business deal. It gave him hope that he might emerge from it all with his future intact. Maybe, if he played his hand right, he’d get to keep the Hummer and a couple hundred thousand dollars. He’d use the money to launch a new Internet business that was legal, or even become an anti-spam consultant.^[10]

Archie warned Bournival that he’d be in limbo until the lawsuit was wrapped up. That could take six months, she said, or even longer if Hawke continued to be difficult.

Over ten days had passed since AOL filed the lawsuit, but the private investigator AOL hired to serve Hawke still hadn’t managed to track him down. The PI knew Hawke maintained a post office box in Pawtucket, and AOL had received information that he was living in nearby North Smithfield. But without an address to go on, the PI was stuck. He hung around vegetarian restaurants in Pawtucket and Providence with a photo he had printed out from a 1999 newspaper article about Hawke. He staked out the former Phoenix Company office on Main Street. He parked on the street outside Hawke’s old Crescent Road apartment, hoping to spot his black Crown Vic. He waited at the tennis courts in Slater Park on the chance that Hawke would show up for a chilly game of spring tennis.^[11]

Then AOL got a tip that Hawke was renting a single-family home at an address on North Smithfield’s Black Plain Road. The PI checked the deed for the property and contacted the owner. She confirmed that the man in the photo was her tenant but had signed the lease using a different name. The PI staked out the tidy colonial for two days, hoping to catch a glimpse of Hawke through the bay window. Upon returning the third day, March 23, he saw the Crown Vic in the driveway. He banged on the breezeway door and called Hawke’s name but got no answer. He tried the front entrance, but still no response.

The PI pulled out his cell phone and dialed the number he had for Hawke. He heard a phone inside the house spring to life. After the phone rang three times, the PI hung up, and the ringing stopped. At that point, the PI realized it was going to be a “nail and mail” case. The PI tacked the envelope to the front door and departed.

Inside, Hawke held his breath until he saw the car drive off. Then he retrieved the documents from the front door and locked it again. He was furious that AOL had been able to serve him so quickly. Now the clock was ticking. By law, if he didn’t respond within twenty days, AOL could ask the court for a default judgment.

Obviously, someone had squealed. Only Hawke’s closest associates knew his home address, so that eliminated Dr. Fatburn, despite the man’s obvious wish to take him down. Hawke’s former partner Bournival potentially had the motivation. To keep in AOL’s good graces, he was probably singing like a canary about his side of the business. But Hawke didn’t think Bournival would give up Hawke’s address. Brad’s innocent mistakes were the cause of their legal problems, but the guy was not a total snitch. The other possibility was Margie, the girl he’d brought up from Columbia whose services he’d stopped using several weeks before out of boredom. (He was still trying to line up a new girl from South America.) But Margie didn’t have the language skills to report him. Besides, she was a best friend of Liliana, and no way would they want to jeopardize Mauricio.

Then it dawned on Hawke—his mother knew his address, although she’d never been to the house. The lawsuit probably brought back for her the shame she had felt in 1999, when her hometown paper, the Boston Globe, reported that Hawke was running a neo-Nazi group. After all, she was the one who had told the Washington Post that Hawke was a “chicken,” and that’s why he didn’t show up at the rally in Washington, D.C. She was the one who, that same year, sobbed into the phone to a reporter from Rolling Stone that she wished someone would kill him, her only son. That’s the kind of mother she was, thought Hawke. If AOL’s lawyers leaned on her, she’d willingly give him up.

Hawke picked up his cell phone from the table. On the screen was a message that he had missed the call from AOL’s private investigator. According to the caller ID, it was from area code 617 in Massachusetts. But the prefix—the three numbers after the area code—was new to him.

“Hello,” Hawke said to the empty house. He jotted the number down on the envelope of legal papers. Later, he would use it to turn the tables and begin investigating the PI. But first, he’d use the number’s area code and prefix combination to create a new mailing list for cell phone spam.^[12]

Under the rules of chess, a player can claim a draw if fifty consecutive moves occur in the match without a piece being captured or a pawn moved. Throughout the spring and early summer of 2004, Davis Hawke seemed to hope the “Fifty Moves Rule” would end his legal problems with America Online.

As AOL made a succession of maneuvers against him in Virginia’s Eastern District federal court, Hawke retreated to the back streets of Pawtucket.^[13] He phoned AOL’s attorneys Archie and Praed a few times to ask questions about the case. But then he’d go silent and flagrantly ignore court dates. From time to time, Hawke would pop up on the Internet to send out a run of cell phone spam. After that, he’d vanish for days, apparently having generated enough cash to keep going.

Hawke had been living in a succession of motels ever since an incident the week after he received AOL’s summons. Hawke had spotted AOL’s private investigator in his driveway, trying to attach something to the underside of the Crown Vic. Hawke assumed it was a global-positioning-system (GPS) device for tracking him. The next day, he moved out of the Black Plain Road house and abandoned the car.^[14]

The cell phone spams, especially the ones advertising mortgage refinancing, were beginning to bring in some decent cash. Hawke decided he didn’t need to spam AOL, and it was a good time for a fire sale with the AOL member database. Using the alias Mark, he boldly sent his bulk-friendly mailing list a message bearing the subject line, “Super Secret Email List for Sale.” The spam offered an eight-million-address list for $8,000, or sets of one million addresses for $1,500:

To throw AOL and other anti-spammers off his tracks, Hawke had begun registering domains under the name “Bubba Catts” and a bogus Louisiana mailing address. Later, his domain registrations included the name and address of the bank in Spartanburg, South Carolina, to which Hawke owed money. For the name of the domain’s registrant, Hawke listed Thomas P. Barnum. Hawke also sprayed out tens of thousands of spams selling pirated copies of the Dark Mailer program. Hawke signed the spamware ads using the name of south-Florida spam king Eddy Marin.^[15]

Hawke temporarily stopped advertising the AOL list in June 2004, after federal agents arrested two men on charges that they had stolen AOL’s entire customer database in 2003 for use in spamming. Jason Smathers, a former AOL technician, and Sean Dunaway, an alleged spammer, each faced up to five years in prison and a $250,000 fine for their part in the conspiracy to misappropriate the database. Prosecutors said they cracked the case with the help of an unidentified informant. The source (Bournival) was said to be a spammer who was the subject of a 2004 AOL lawsuit. The informant had purchased a copy of the list from Dunaway and used it to sell herbal penile-enlargement pills, authorities said.

Suddenly, Hawke’s endgame with AOL wasn’t the only case that required his attention. Now he was potentially facing criminal charges over his brazen attempts to sell the AOL member database. Concerned that FBI agents might be following him, Hawke cut off his shoulder-length hair and shaved his head. But soon he was back on SpecialHam.com, under the username MrLucky, offering to sell an AOL address list for $6,000.

Then, at the end of June, fresh legal problems arrived. A private investigator hired by Verizon Wireless left a summons on the windshield of Jacob Brown’s blue Oldsmobile while it was parked outside 40 Crescent Road in Pawtucket. (Brown had taken over Hawke’s old apartment when he moved out.) The summons informed Brown that Verizon Wireless was suing him and fifty unidentified “John Does” in a New Jersey federal court. The cell phone provider accused Brown and the others of inundating its subscribers with over four million cell phone spams since March 2004.

Hawke was undaunted by the fact that he might soon be dragged into the litigation.^[16] In July 2004, he spammed his bulk-friendly list with an ad that began, “Become an cellphone spammer.” The spam advertised a $1,000 kit with “everything you need to start mass mailing text messages instantly.” The ad, which was signed “Eddy M,” included an unusual revelation as proof the offer was legitimate:

A few days later, Hawke decided it was time for a breather. He drove north to his favorite spot in New Hampshire—Tuckerman’s Ravine, on the southeast shoulder of Mount Washington—for a hike with Dreighton.

The summer of 2004 was shaping up as one of the coolest and rainiest on record in New England. As Hawke picked his way in a drizzle along the Lion Head trail, he contemplated leaving the country altogether for someplace warm and dry—Algiers, perhaps. Loay Samhoun, his former number-one Pinacle affiliate, had already fled to Lebanon to avoid litigation from AOL.^[17]

But with almost all of his money in greenbacks, Hawke knew he had serious portability problems. Somehow, he’d need to get the cash into bank accounts, but he worried that those deposits might trigger investigations and put him at risk. Hawke figured he could disappear somewhere else in the U.S. and start over under a new identity. He could use his cash to buy and sell real estate. Or he could earn a living playing poker.

But Hawke decided to remain in Rhode Island a while longer. His only friends—Mauricio, Mike Clark, and the others—were there, and Patricia was serious about her grad school program. But something else made him want to stay put.

Hawke had tried running from failure in the past, and it got him branded a coward and a loser. This time, he wasn’t going to slink out a window in the middle of the night. He was going to go down with guns blazing. He might not be the biggest spammer in history, but Hawke was going to make sure he was the most outrageous one of all time.

The mist lifted suddenly, allowing Hawke a glimpse of the Mount Washington valley below the grey ceiling of clouds. He vowed he would retire from spamming after he made a little more money. Until then, he’d stick to his credo: I’m going to be dead for a very long time. Every moment counts.