After a counter-attack by spammers that knocked out millions of Typepad and Tucows customers, Blue Security has surrendered.

The company has pulled the plug on its controversial anti-spam efforts, which were based on filling out an opt-out form on a spammer’s website every time an unsolicited message was received.

Blue Security management figured the aggregated efforts of Blue Frog clients across the globe would effectively tie up spam servers, making it impossible for spammers to ply their trade.

As Blue Security chief Eran Reshef reasoned in 2005, “The sheer amount of complaints going to the spammer’s site is going to make it hard [for that site] to do anything else.”

Detractors viewed this approach as, by definition, a Denial of Service attack, which is considered by many to be illegal, immoral, and likely to lead to unforseen consequences that can hurt innocent bystanders.

In Blue Security’s capitulation letter, officials tacitly acknowledged the hole in their strategy:

Spammers launched a series of attacks against us, taking down hundreds of thousands of other websites via a massive Denial-of-Service attack and causing damage to ISPs, website owners and Internet users worldwide. They also began a relentless campaign of email intimidation against many members of the Blue Community.

After recovering from the attack, we determined that once we reactivated the Blue Community, spammers would resume their attacks. We cannot take the responsibility for an ever-escalating cyber war through our continued operations.

Many anti-spammers are delighted with Blue Security’s change of heart. For example, David Cary Hart of tqmcube commented:

What is interesting is that the firm founded by IT security experts is basically conceding that they cannot handle a DDoS. Only a week ago they claimed victory against the evil forces.

Hart and others are convinced that the company simply burned through its initial $4.8 million cache, and was unable to raise second-stage financing, due to lack of a “reasonable financing model.”

Indeed, a review of the Benhamou Global Ventures portfolio may bolster that guess. Though BGV provided earlier funding, Blue Security isn’t listed.

From now on, Blue Security management says it will apply its technology in new directions. No more spam fighting.

Meanwhile, although Blue Security claimed it would keep its community site open till the end of May, as of this writing, the site is inaccessible.

So here are Blue Security’s final words:


Blue Security Ceases Anti-Spam Operations

When we founded Blue Security in 2004, we believed that if we automated a way for users to rise up and exercise their rights under the CAN-SPAM Act, we could reduce the amount of spam on the Internet.

Over the past few months we were able to leverage the power of the Blue Community and convince top spammers responsible for sending over 25% of the world’s spam to comply with our users’ opt-out list. We were making real progress in eliminating spam from the lives of our users.

However, several leading spammers viewed this change as a strategic threat to their spam business. The week before last, these spammers launched a series of attacks against us, taking down hundreds of thousands of other websites via a massive Denial-of-Service attack and causing damage to ISPs, website owners and Internet users worldwide. They also began a relentless campaign of email intimidation against many members of the Blue Community.

After recovering from the attack, we determined that once we reactivated the Blue Community, spammers would resume their attacks. We cannot take the responsibility for an ever-escalating cyber war through our continued operations.

As we cannot build the Blue Security business on the foundation we originally envisioned, we are discontinuing all of our anti-spam activities on your behalf and are exploring other, non spam-related avenues for our technological developments. As much as it saddens us, we believe this is the responsible thing to do.

You need not do anything as a result of this change. We will continue to protect your names and addresses and honor all privacy commitments we made to you.

We have concluded we should not take Blue Security to the full deployment stage we originally planned to achieve, but we are proud of what we have accomplished thus far as a young startup company.

We are extremely proud to have had the chance to work with such a devoted and dedicated community: thank you for the vote of confidence you gave us over the past few months as well as the particularly vocal support you have shown over the last two weeks.

We will be innovating and building our technology in new, other directions and will continue to give back to you, our Community.

Thank you for your support,
The Blue Security Team.

Or, as Todd Underwood of Renesys wrote, “Live by the DoS, die by the DoS.”

Email Battles Backgrounder: