In the long run you should quit. What’s the next questionable thing to be asked of you?

For the time being, put yourself in the position of one of the spammees: put your private email on the list and report the received mail to Vipul’s Razor. Report a new IP to the blacklists yourself before it’s used so even the first wave never arrives.

Be sure to take these countermeasures from home or otherwise in your private time, not on company time. Don’t disobey any orders while at work – like by sabotaging the actual spamming itself.

Makeshifts last the longest.

++. I really like this solution. It's elegant in that you do your job to the full of your ability at work - no-one around you will be able to doubt it, even if they bring in an independ auditor to check on you. Then you go home and in five minutes you torpedo the efforts of your evil company.

Bonus points for sending your torpedo through an anonymous email service.

____________________
Jeremy
I didn't believe in evil until I dated it.

I can imagine your discomfort in this situation. While I would at first have suggested having his email as the reply-to address (or have postmaster forward bounces back to him), you did say you wished to retain your job, so I won't suggest that particular solution. For this reason, I also will not suggest slowly sabotaging or causing the program to slow for the same reason.

One thing you may do is warn him and his superiors of the potential reprocussions, such as the fact that users in several states have the right to take you to court or sue your company for spamming and the potential costs involved in defending/answering these cases. You might also advise them that even though they currently have the server through XYZ big server company, if they get enough complaints or the emails cause them enough problems (such as causing their allocated blocks of IPs to be blocked, possibly resulting in impact to them or to other customers), they still have the right to decline to provide service to your company.

It is my hope that other monks herein can provide other helpful suggestions. I sincerely wish you luck in finding a solution, and I hope if you do that you will post a follow-up telling the solution you choose.

Update: I could not recall the articles I had seen recently regarding lawsuits and spam. I searched and found several of them (warning: outside links), including references to lawsuits and legislation in Utah (also here and here), Ohio, Washington, and California, the economics of spamming, why spamming doesn't work as expected, suits by the FTC, and spammers being sued to stop using a particular service, among others.

Of course, if it's illegal to send spam in your jurisdiction, you can refuse to do it, and take legal action if they fire you for not doing your work.

What you should NOT do is to sabotage the sending of the spam. That would just give them to many hooks to fire you (and maybe even sue you).

Of course, the most ethical thing to do is to quit.

Abigail

Higher-ups in the company will get very concerned if they hear that the company's reputation is taking a hit (even a small one), custom could be being lost rather than gained, and that negligible benefit has been realised. Ensure that your boss is kept aware of the complaints received, either from end receipients of the spam or from ISPs; even if he isn't concerned that what's being done is wrong, he will hopefully appreciate the negative impact on business it will have. Alternatively, what do the 'big servers company' think of this? Potentially your local ISPs could start blocking ranges of IP addresses, which could *really* concern your hosting company.

Sabotage is a dodgy way to go, I'd be inclined to (1) ensure he is aware that you think it's a bad idea, and (2) do exactly what he says. Not a good way to go, but so long as your concerns are recorded, it's probably all you can do given that what the company's doing probably isn't actually illegal.

Good luck.

ethics involves putting your principles ahead of even your best interests.

this means that if you consider yourself a professional and an ethical person, you will refuse to do something that goes against your principles even if you know it will cost you your job.

i know that's probably much easier for me to say standing way over here, but nobody ever said being ethical and principled is easy. by helping your boss spam, you are condoning all spam.

"Non-cooperation with evil is as much a duty as cooperation with good."
-- Gandhi

anders pearson

Unless you're in a state that permits people to sue spammers for lost bandwidth and harassment, it seems to me that you'll have to make your case based on the economics of the situation. For example, try to demonstrate one or more of the following:

• that the revenue generated from spamming does not justify the expenditure of time and money finagling IP addresses to stay ahead of the ISPs and maintaining specialized servers.
• that you as a programmer would be better utilized if called upon to actually build something of value.
• that you are experiencing or expect strong customer backlash.

Good luck!!

When I get spam from a legit company (example: BlackIce harvested the Microsoft Pocket PC newsgroup and sent ads to everyone) I send them a letter explaining what happened and, in case the higher-ups don't know what the ad guys are doing, explain why this is wrong, and by the way I blacklist any company that spams, so it amounts to ANTI-advertising.

So, has your company gotten any complaint letters, or just POSTMASTER bounces?

If getting complaint mail, it might be handled by a different chain of command, and saner heads can get involved.

—John

Now is the time to update your resume.

The other advice you've recieved is good, and I would suggest working to mitigate the damage without personally sabotaging the SPAM runs. I'd be wary, however, of reporting your servers to any blacklists--you may get yourself sued. If you are harvesting email addresses, you might make sure some cauce.org addresses get on the list ;).

If your boss is a sleazebag and won't stop SPAMMING, try talking to his boss. Focus on the business side of why this is a bad idea. Businesspeople care about money and little else. You will need to be able to show that SPAM will cost your employers more than it will make them. Check out CAUCE

If you are asked to do something unethical once, you will be asked to do so again, so leave as soon as possible. If your boss is reprimanded, it may be possible for you to stay, but even then he is likely to blame you for his problems.

If your employer does not cease spamming before you find other work, you can offer to 'help' by updating the job description for your replacement. Be sure to include a line about sending bulk emails. That way, anyone who applies for the job has a reasonable warning that they will be asked to spam.

TGI says moo

Then start looking now, so that you can have a choice about leaving it.

OK, so I am posting anonymously too because basically my advice is to cheat your boss (I don't think _my_ boss would appreciate ;--).

How technically knowledgeable is your boss? Could you just not send the emails to ISPs that have banned you, but generate the returns to the postmaster anyway? Send just 1/10th, or 1/100th of the mails you are supposed to send (sendmail is Open Source after all, youre just a patch and a recompile away from a non-spamming version of the tool, I am sure you could find plenty of people who would do this for you).

Finally: do you really want to keep a job at a company that seems on its way to being in real trouble with the law? How long do you think this company will be in business for? And if they don't listen to you, maybe the authorities will?

how technically knowledgeable is he? well, in a scale of 1 to 10 he's 1.5 I may say. I already cut down the list to 60,000 out of a peaked 120,000 and from what I see, this saturday the list might become a small 20,000 (without them knowin of course) but still, the whole idea of administring a spam sending server.

as for the law, we are not in the US, and where we are, online laws do not exist, so I couldn't count on that.

If you can't use the law, use the bottom line.

Sending Spam is bad PR, and most thinking warm bodies reject spam and the person/company that sends it.

John J Reiser
newrisedesigns.com

I think the main thing you need to decide is whether or not you really want to work for this company. This is not a mistake or a matter of simple ignorance. Your boss is actively seeking ways to get around people who don't want to participate in his spamming. He is stealing resources and annoying people. He is contributing to what is seen as one of the biggest problems on the internet. Sadly, as long as you are part of the project, so are you.

I don't mean that to sound harsh. We all need to earn our living, somehow. Maybe where you live it is hard to get jobs in your field or maybe the pay is exceptionally good. You just need to decide what you need more: peace of mind or the job. If you weight the risks and consequences and decide the job is more important than your principals, then you need to do your job the best you can, even if it means spamming. If you truly have no way to involve outside authorities or stop the spamming and you really can't stand to be involved in the spamming, you should cut your losses and leave the job.

I wish you luck, it sounds like quite a dilemma.

SpaceAce
s>>sp>;s>..|>\u$&ace>g;print;

If you were given a specific list of accounts to bulk mail, then possibly your boss has already ensured his account is not present. Why not try making his address known to other spammers, perhaps by posting it to a newsgroup or signing up for some iffy free services? If you do this at only a moderate rate, it is less likely to arouse suspicion.

To reinforce what has been said before, creating a throw-away anonymous account (Hotmail, Yahoo, etc.), sending the spam that way, then reporting it seems to be quite an ingenious approach.

Above all, however, I would suggest resigning from this ethically-questionable job.

-----------------------------------
Washizu
Acoustic Rock

When the company fell on hard times, the CEO started delaying deposits into the account at the benefit company. Claims payment stopped cold. Since I was married to the HR person at the time, I knew what was going on. We started looking for work immediately. It took us 6 months and a geographical re-location to leave. The company lasted for another 4 years, then crashed.

I've left before, and I'll do it again if I have to. I urge you to start looking now. SPAM today, fraud tomorrow.

Suppose the kind monks would "accidentally" end up on your mailing list, maybe some of those would be inclined to send a letter of complaint to your company?

It's a small world after all... -gjb-