Devil's Advocate: How to catch a spammer

To show how hard it is to track a spammer through legitimate means, Martin Brampton attempts to hunt down some individuals plaguing his website. See how far he gets - and what stands in his way.

In a recent column, I wrote of my frustration at link spamming. The likelihood of resolving this problem through the law looks remote. Consequently I remain sceptical about the prospects for regulation of the internet by traditional legal means any time soon.

First, I would like to get one thing clear. One reader evidently got the impression that I was thinking of murdering spammers. This is not the case. However annoying they are, I have not the slightest intention of murdering anybody. The furthest I would go might be to suggest that a well placed thunderbolt could be welcome.

The painful fact is that we have a global system in the internet, which in many ways is extraordinarily beneficial. But we most certainly do not have a global legal system.

But I do find that legal or simple practical mechanisms are entirely inadequate when it comes to link spamming. This anti-social practice occurs with websites that make themselves open to change by visitors. While it is always possible to harden such a website, the time and maybe money needed to achieve this may well be beyond what is practically justified.

The spamming of my documentation which I described in that previous column has continued. So I have been looking for ways to block it. This is easier said than done. The system records the IP address from which the unwanted editing was carried out. That is little use, since the addresses point to locations all over the world. The most likely explanation is that computers compromised by Trojans are being used without their owners' consent. Even if I could track them down, the owners are blameless, and there is a practically inexhaustible supply of such machines.

An alternative angle is to look at the sites being promoted and seek to take action, through proper channels, against them. Once again, that is far easier said than done. At least three different domains have been used to spam my site but they all point to exactly the same page. Yet the domains purport to be registered to entirely different people.

One of them remains anonymous. Another purports to be located in Beverley Hills, California but has a telephone number with a country code that suggests they are in South Korea. The third claims to be in Atlanta, Georgia but has a country code of +745, which is so obscure I cannot find any country that lays claim to it.

Chasing the hosting ISP is only slightly more fruitful. It seems that all the domains causing the problem are hosted at the same place. Not surprising, given that they all show the exact same page. The ISP turns out to be Estdomains of Estonia. I have written to them but if they choose to ignore me, I am not at all sure how to start legal proceedings against an Estonian organisation. In any event, they would doubtless deny all responsibility for the actions of their customers.

Persuading them to terminate the hosting of the sites might seem a victory. But it would doubtless be temporary. With the cost of domains now a few pounds per year, and with countless of hosting companies scattered across the world, there is no doubt the operation would be set up again very quickly.

The painful fact is that we have a global system in the internet, which in many ways is extraordinarily beneficial. But we most certainly do not have a global legal system, or even any clear agreement on what such a thing would be like. Without such a system, legislation in countries that are already well-regulated has little point, and will leave us vulnerable to abuse from elsewhere. In those circumstances, the easiest response still looks like retaliation in kind.