From: /dev/null (null[at]
To: gene black (
Cc: staff[at], legal[at]
Date: Mon, 23 Apr 2001 16:25:07 -0600 (MDT)
Subject: Re: you insist , oh!

On Mon, 23 Apr 2001, gene black wrote:
: It does appear that your insistent on avoiding simple solution to my
: issues regarding the use of my trademark.

Excuse me a moment -- I'm going to jump in here.  I'm afraid there seems
to be a profound miscommunication going on; let me see if I can alleviate
some of the problems.

Regarding your trademark (and by 'trademark' I assume you refer to the
phrase and URL ''), let me refer you to the section on 'fair
use' in U.S. copyright law (please see US Code Title 17, Section 107:
Limitations on exclusive rights: Fair use) which states that fair use is
determined in a particular case by considering (1) the purpose and
character of the use, including whether such use is of a commercial nature
or is for nonprofit educational purposes; (2) the nature of the
copyrighted work; (3) the amount and substantiality of the portion used in
relation to the copyrighted work as a whole; and (4) the effect of the use
upon the potential market for or value of the copyrighted work.  

To wit, Mr. Black, Attrition is entirely non-profit; we make no money off
of our mirror.  The nature of the copyrighted work is quite clearly
intended for public consumption -- you -do- have a commercial site, and it
is to your benefit to dissemenate your site's name.  The amount of the
copyrighted work used consists of one word: 'Namestyles'.  As to the
fourth, you do have a point in that the effect is certainly negative.
Because you have a point as to the fourth item, I offer you this
compromise: if you will kindly look over the source of the web page
(pleas be sure to view the source, because the defacement seems to have
been poorly coded) as displayed at"/mirror.html
and point out specific examples, in that page, of your copyright being
violated -- i.e., places in that page that you feel violate the fair use
section as stated in US Code Title 17, Section 107 -- we will in good
faith consider your request.

: It appears to me that you are aware of the hacks in advance by the
: repeat of the same hacker identities throughout the list and the number
: of hacks and mrrors you allege each month without any proper form of
: verification as to the reality of the hack (ie:maybe "fuxor" is a
: disgruntled employee permissably into the server).

The fact that there are many of the same groups actively defacing web
sites does not logically indicate that by dint of reporting the
defacements we are somehow privy to them beforehand.  To accuse us falsely
and irresponsibly of conspiracy to commit computer fraud or accessory to
computer fraud before the fact is tantamount to libel. 

You are correct in that the attack could have been perpetrated by a
disgruntled employee -- however, were that the case (as has been the case
in some previously reported defacements), Attrition would still consider
that a valid defacement and we would still mirror it.  A defacement is
defined (q.v. as an
incident "when the content of a public web page is altered by someone
other than the legitimate person responsible for the machine or pages.
This is regardless of reasons or motivation.  In simple terms, if someone
types a URL into their browser and sees anything but the legitimate page,
this is a defacement."  It is very obvious that the "fux0rology" content
on the mirror we took is not the legitimate page for
Regardless of who put the defacement on the server, it -is- a defacement;
thus Attrition reports it.

: True verification would need to come from the victims, which I'm sure
: you do not have. 

In many, many cases, Mr. Black, Attrition does have verification from the
victims.  Attrition provides free security advice to victims of
defacements (q.v. Attrition's original email of notification to you), and
many victims of web site defacements take full advantage of that service
(provided entirely without compensation; Attrition, as mentioned before,
is a non-profit volunteer effort).  In this case, Mr. Black, your argument
is comparable to the New York City subway system insisting none of its
subway trains have ever been subjected to graffiti simply because NYC
Transit has not admitted to the trains' being spraypainted. 

: Investation & discovery may reveal you to actually be aware of the
: hackers true identities. . .we'll see. Your indifference to my simple
: request is amazing!. . . obviously you have little or no value placed
: upon your time. 

Attrition's initial mail to you encouraged you to notify your local FBI
field office, and in fact offered instructions as to how to do that.  We
strongly recommend that victims of attacks such as this follow up prompty
with the proper authorities, as time is of the utmost importance in
maintaining the purity of electronic evidence (q.v. United States v. Ojeda
Rios (1990) 495 U.S. 257; also q.v. United States v. Pedroni, 958 F.2d
262, 265 (9th Cir. 1992)).

Your request, Mr. Black, is -not- simple.  Your request is a direct
violation of Attrition's publicly stated policy (q.v. regarding the
publication of mirrors of defaced sites.  Your request was not even   
couched as a request -- it was sent as a demand and a threat of
legal action, and has never been sent as a polite request.  Your -demand-
has been met with a simple answer several times -- 'no' -- and your threat
of legal action has yet to materialize.

: Your claim of providing stats is hollow and terribly discredited by the
: defamation of the victims character and integrity. Filing complaint
: followed by a request for temporary injunction of your entire site will
: be my pleasure. 

As you may be aware from having read our pages, Mr. Black, Attrition's web
mirror and defacement statistics are resources widely utilized by law
enforcement, government agencies, and computer security professionals in
tracking the perpetrators of online crime.  Attrition's web mirror is
frequently referenced in an FBI newsletter, as well as being frequently
cited by media organizations such as MSNBC, ABC News, the Associated
Press, and CNN.  While it is your prerogative to believe those statistics
are discredited by Attrition's attitude in response to your threats, it is
certainly not an accurate assessment of the situation.

Regarding a temporary injunction of Attrition's site -- as you may be
aware, it is inappropriate for you to contact any member of Attrition's
staff directly once that motion has been filed.  Please have your lawyer
address any further correspondance to legal[at]

main page ATTRITION feedback