Legal process for suing joejobber?

Question

I'm currently being joejobbed, and want to sue the joejobber. Details:

• I have real damages: the joejob causes me to receive fake bounces, which:

  • stop/delay my receipt of legitimate mail, since Gmail limits how much mail I can receive in a given period of time.

  • uses up my time to delete these bounces. Gmail catches many, but not all, joejob bounces.

• I found the joejobber's IP address by looking at the bounces that include the header information of the message they received. Of course, not every bounce has this.

• Right now, I just need the first step: do I file John Doe suit, do I subpoena the ISP, do most ISPs have a formal procedure here, etc.

• I realize the joejobber's probably using a botnet of innocent people's computers, but I'd still like to proceed, since:

  • I can warn the affected people.

  • In theory, I could sue the affected people for negligence. I realize this won't go anywhere, but it'd be nice to explore the possibility that people have some legal requirement to protect their computers from being used harmfully by other parties.

EDIT: A joejob is when a spammer sends email spoofing your email address/domain. Among other things, it results in you getting bounces for email you never sent. http://en.wikipedia.org/wiki/Joejob

Answer 1

It is extremely improbable that any IP address you retrieve from the header links to the spammer. Almost all spams nowadays go through botnets. Also, remember that message headers are as fake-able than message contents; usually, after careful analysis, you can determine which is the first trustworthy mail host through which the spam went, and possibly that mail host may have added the IP address from which the mail came -- which may be only a gullible open relay.

Therefore, while you can usually have reasonably accurate information on which machine is part of the botnet, you will have a hard time finding proofs which could hold in court. Also, 99% of the time, the infected machine is a home PC and the ISP will not give you any name unless forced by a court order -- which may become tricky since most home PC are from other countries. Chances that an ISP will react on your complaint are nil. As a way to warn innocent owners of infected machines, a lawsuit is about as appropriate as trying to squash mosquitoes with a sledgehammer: even with awesome amounts of luck, results will be miserable and completely disproportionate with the invested efforts; and there is a high risk of backfire.

Theoretically, German law makes owner of open WiFi access points responsible for what goes through, to a limited extent. I have not heard of any actual enforcement of that law yet.

Answer 2

In addition to the technical difficulties that @Thomas raised, both in discovering the actual IP address and in getting legally-recognized proof, you still have to deal with the basic legal questions here:

• Is joejobbing even illegal? This would depend greatly on your locale, and you should DEFINITELY consult a lawyer, specifically one with technical experience in this domain. Since you mentioned in a comment that you're in USA, I'll just say that I'm very not familiar with any applicable law here.
• Even if you did find a relevant, applicable law in your jurisdiction, chain of evidence requirements would apply - and unless you're set up for this ahead of time (and I'm pretty sure your email provider is not) this will be notoriously difficult to meet.
• One thing that may be applicable, is violation of TOS. E.g. if this is Gmail, then they bind you to their terms before using it, and if the joejobber violated those terms then Google has contractual basis to press charges. Note that in this case it would be Google that can press charges, not you, and that would be highly unlikely (unless it was a sufficiently high-profile case). Also note that the technical difficulties would still apply...
• As for suing for monetary damages in civil court (assuming you get past the technical difficulties), the damages you claimed in your ppost are really not sufficient. Of course IANAL, but loss of time (and lets face it - its not a LOT of time), and limiting your use of a 3rd party service, is not really enough to go to court with. I dunno, mebbe Judge Judy would take this on...
• Wrt suing the victims of a botnet, it really doesnt work that way... unfortunately. Negligence would not meet the basic tests, and there would still be a bunch of technical difficulties to deal with. Not to mention the perception that "you're suing the victims"...
• As for warning them - I would say not to bother. Odds are they wouldnt know what to do with it, and furthermore since its not your responsibility you're just gonna be putting yourself in an uncomfortable situation of dealing with them (at best). Unless you're offerring to sell them tech services :) ....

Bottom line, not really much you can do about this... Spam is the scourge of the Internet.
You're just better off sending out an email to your existing clients and warn them about possible spam and phishing allegedly from you...
And, possibly consider applying common security mechanisms for your future emails: e.g. digitial signatures (S/MIME or PGP), apply MX records to your email server (if you host it), etc...