From: Network Administrator tech3@nycap.rr.com
To: xxxxx
Subject: You Will Be Disconnected If You Continue...
Date: Saturday, April 18, 1998 12:21 AM

Road Runner
Albany Division
50 Water Plant Road
Troy, NY 12182
(518) 464-9000
abuse@nycap.rr.com

It has come to Road Runner's attention that you are operating a server(s) (i.e. web, ftp, smtp, domain, pop-3, gopher, uucp, irc, quake, gaming, wingate) and determined that you have failed to comply with the terms of the Road Runner Subscription Agreement and AUP, which states that such services may not be run without the express written consent of Road Runner.

This (these) server(s) are to be taken down within 72 hours of this e-mail.

Should you have any questions or problems regarding this, please address them to abuse@nycap.rr.com or you may call 518.464.9000 during normal business hours. Please reference your IP address and this e-mail when calling or e-mailing.

Please be aware that the continued operation of this (these) server(s) after the 72 hour period may, after review, lead to the suspension or permanent cancellation of your Road Runner account.

Sincerely,
Road Runner Administration

After receiving phone calls from panicky customers (many who had no idea what the terms in the message meant) they issued the following retraction.

From: John Reinhardt reinhj@nycap.rr.com
To:xxxxxxx
Subject: Server Operation Clarification...
Date: Saturday, April 18, 1998 5:39 PM

If you are receiving this email, you have probably received another email from the Road Runner Group regarding the termination of your account for running a server. If you didn't receive that email, please ignore this as it doesn't apply to you.

Let me start off by apologizing for the blunt and threatening email sent by the systems department. There will be no immediate termination of your account. It wasn't very explanatory and targeted a much larger group than was necessary.

In this email, I'll explain why servers were monitored, why the email was generated, and what (if anything) you as a user need to do.

Why were servers monitored:

In order to keep the speed of Road Runner at a level acceptable to the users, we constantly monitor the bandwidth in order to determine if there are any problems or reasons to be alarmed. According to the AUP (Acceptable user policy), servers are not allowed to be run on user's PCs. Until now, the staff has been very flexible with the policy and has asked that you just email us if you would like to run a server. Due to large bursts of data transfers and speed degradation usually associated with servers, our systems team has decided to scan the RR network for servers. The scan was system wide and covered all users and all ports. For those of you who are wondering if this was a security attack, the port scan only checks to see if a port responds to a telnet request. Response on certain ports indicated a certain type of server. The results showed an alarming 1100 servers. All of which have the potential to adversely affect the system.

Why was the email generated:

The systems team found several servers distributing copyrighted software and performing other illegal activities. Finding all the servers that were causing problems would have been too time consuming and so the course of action they took was to mail all users who were reported as having servers running. The tools to accurately find the users who are causing this are very costly and unavailable at this point. In the future, mass emails of this nature won't be necessary, but the problem had escalated past the point where the systems team could wait.

What do you need to do:

In order to resolve this quickly and make sure that everyone's questions and concerns are addressed as rapidly and accurately as possible, please follow these directions.

If you are unsure why you received this email, please send email to helpdesk@nycap.rr.com with the subject: "Confused about servers", chances are your system has something running by default and you don't even know it.

If you want to run a legitimate server, email the type of server, whether or not you'll use standard ports, and the reasons for it to helpdesk@nycap.rr.com with the subject: "Requesting servers". We don't have any problems with you wanting access to your home PC from wherever you are.

If you are actually one of the few people causing the problem for the rest, please take down your server immediately. There will be no 72 hour limit. We will be purchasing the tools necessary to track down the problems without affecting the rest of the users and you will be contacted.

Again, if you have any questions or feel that you need to come visit us to resolve this. We are located in the Troy Time Warner building and always welcome visitors. Please continue to use and enjoy the service as it was meant to be used, not abused.

John Reinhardt
Director, Technical Services
Road Runner - Albany