This page created by Ron Newman.
Last revised May 5, 1996.
Cancelbunny comes out of hibernation: Skip forward for latest news
Members or allies of the Church have tried to remove messages written by other people in the Usenet discussion group alt.religion.scientology. They did this by sending unauthorized cancel messages, which are specially-formatted messages instructing Usenet servers to delete a previously posted message. Here's an example of such a cancel message, and here's another. Some of these cancels were accompanied by text claiming that the original message contained violations of the Church's copyrights and trade secrets. But copyright disputes should be settled in a court of law, not by faceless vigilantes issuing cancel messages.
The first such cancels started around Christmas of 1994, and were sent by harryj@netcom.com (Harry Jones), who did not understand his news-posting software well enough to conceal his true identity. He eventually got smarter, and later cancels came from the non-existent account robocanceller@netcom.com. The cancels quickly attracted the attention of Time magazine's Netwatch column, which mentioned them in the January 16, 1995 issue. After weeks of complaints, Netcom's system administrators finally installed software that forced anyone sending a cancel to reveal their true identity (or, at least, their Netcom user ID). Subsequent cancels then came from: mako@netcom.com (Michael Clark), student@netcom.com (John Palmer), and bettyj@netcom.com (Elizabeth Jones). Netcom soon disabled logins from all of these accounts.
It was around this time that I gave this abuser the name "Cancelbunny". Not only did it hop from one account to another, but just as in a famous American television commercial, the Cancelbunny kept going, and going, and going....
Soon afterwards, two more cancels originated from the site deltanet.com, and claimed to come from the address noman@odesi.com. Don't try to send e-mail there; it's a non-existent site. But the good news is that, on March 6, the good folks at deltanet.com found and terminated the accounts of two users who issued forged cancels from their site. Here's a report from deltanet's system administrator..
That stopped the cancels for a few weeks, but they returned again on March 30, this time using a bogus Path: header that falsely implicated the site demon.co.uk. Here's an example, dated April 7. The Cancelbunny disappeared yet again after a few weeks, but came back with a vengeance in early July. Careful sleuthing eventually determined that the canceller was injecting his cancels into the open NNTP port of ccvax.ucd.ie, a VAX at University College in Dublin, Ireland. The administrator of that system quickly closed off access once notified of the abuse.
Days later, the rogue cancellations started up once again; here's an example from late July. In response, an ad-hoc group of netizens calling themselves the "Rabbit Hunters" spontaneously assembled to carry out an investigation. (The author of this web page, Ron Newman, is one of the "Rabbit Hunters".) The amateur investigators determined that the the cancels were now being inserted at still another open NNTP port, namely louie.udel.edu, a machine belonging to the Electrical Engineering Department of the University of Delaware. In mid-July, the "Rabbit Hunters" informed the administrator of this system of the abuse.
Instead of closing off his open NNTP port, the UDel administrator agreed to deliberately leave it open, while making its log files available to the "Rabbit Hunters" via the World Wide Web. This allowed the investigators to closely track the abuse, and they quickly determined that the cancels were coming from two separate Internet Service Providers in Southern California: Directnet (mach1.directnet.com) and Kaiwan (kaiwan009.kaiwan.com).
On August 7, the UDel administrator closed his open NNTP port, and the cancels temporarily stopped. The Rabbit Hunters notified both Kaiwan and Directnet, and issued a press release on August 15. A week later, the Rabbit Hunters issued another statement entitled "Anatomy of a Cancel", demonstrating how several cancel messages were traced through the UDel logs on July 14 and 15.
The adminstrator at Directnet cooperated readily with the investigation, but the administrator at Kaiwan took much longer to deal effectively with the problem, and the cancels started once again, this time sent directly to Kaiwan's own NNTP port with a false Path: header. (Here's an example from August 21.). The Rabbit Hunters believe they have overwhelming evidence that the account bstone@kaiwan.com (Brian Stone) has been used for this purpose. This account had been used to post a large amount of pro-Scientology propaganda earlier in the year.
On Thursday, August 24, some time shortly after 23:00 PDT, Kaiwan disabled the
account bstone@kaiwan.com by setting its Unix shell to
/etc/.abuse. Even after that, a second Kaiwan
user, probably davisr@kaiwan.com (Rick Davis),
couldn't resist the temptation to send a few more forged cancels;
here's yet another, one of
several that arrived the morning of Sunday, August 27. After that,
the Cancelbunny left Kaiwan, only to briefly return in October (see below).
Unfortunately, the same night that Kaiwan disabled bstone's account, they also disabled the account of one of the Rabbit Hunters, Tom Collins (tommyc@kaiwan.com), claiming that Tom's use of the Unix `ps' commmand to track bstone's activity was itself an abuse. Kaiwan's owner, Luke Hwang (luke@kaiwan.com), refused to discuss the situation with Tom, while leaving Tom's account in `suspended' limbo for over three weeks. During all of this time, Tom had no access to his files or to the mail that continued to accumulate in his account. Luke then deleted Tom's account entirely on September 16. Now Tom's files and mail may be gone altogether.
Kaiwan refused to deal with mounting complaints about both the August 27 cancels and their treatment of Tom. If you don't like Kaiwan's attitude towards all this, send e-mail to any or all of the following addresses: luke@kaiwan.com, edchiu@kaiwan.com, root@kaiwan.com, admin@kaiwan.com, admin1@kaiwan.com, admin2@kaiwan.com, admin3@kaiwan.com, acct@kaiwan.com .
Meanwhile, forged cancels showed up again at Netcom on Friday, September 8. Because of software that Netcom installed back in February, the Cancelbunny this time was unable to conceal his account name; these cancels clearly came from niner1@netcom.com (Robert Adams). (Here's one of these cancels.) Netcom now acts fast when it receives complaints about cancel abuse; it suspended the niner1 account in less than a day.
Unbelievably, yet another Netcom account, aggy@netcom.com (James Parker) issued at least seven more forged cancels on Monday, September 11. Here are several of these cancels. These cancels are especially blatant; some are even signed "Cancel Wabbit"! After Netcom suspended that account, still more cancels came from icecube@netcom.com (Bob Wallert) on Friday, September 15. Once again, Netcom quickly suspended the abuser's account. The same thing happened to two brand-new Netcom accounts, keywest1@netcom.com (Bill Keyes) and chipman@netcom.com (Alex Munchnik) that posted cancels on September 18 and 22 respectively. Netcom kills Cancelbunnies dead.
A new Cancelbunny, seanm@digital.netvoyage.net, posted several cancels on September 25. (The same account had posted a syntactically incorrect attempt at a cancel on September 13.) David Dickter, an administrator at NetVoyage, told me that seanm was an "unauthorized user", and terminated his access on October 4.
Two more bunnies showed up on October 14, trying to cancel copies of the e-zine Scamizdat #11 that had been anonymously posted to comp.org.eff.talk. This cancel was posted under the name "Vera Wallace", a pseudonym often used to post especially nasty pro-Scientology messages. The other cancel, which was actually syntactically invalid, came from "Rick Davis" (davisr@kaiwan.com), another Kaiwan user who had posted voluminously on behalf of Scientology earlier in the year. This time, Kaiwan did the right thing and suspended the davisr@kaiwan.com account; it's now totally gone.
After October 14, the Cancelbunny entered a long period of winter inactivity, leading many of us to believe it was dead. But then....
Early in the morning of February 13, 1996, the Bunny returned to Netcom yet again, this time under the name spells@netcom.com (Bill Spelling). Its target was an anonymous re-posting of Scamizdat #11, this time from the anonymous account an498608@anon.penet.fi (DarkDemonStalker). As before, Netcom suspended the offending account a few hours after receiving notification from the Rabbit Hunters.
Two subsequent postings of Scamizdat #11 were also cancelled by Netcom Cancelbunnies: massy@netcom.com (Massoude Radmanesh) on February 20, and gmart@netcom.com (George Martin) on February 28. Netcom's security manager, Margaret Petit, propmtly suspended both accounts and posted an official Netcom response on February 29th.
On March 30, cancels were sent from the account carlo@netcom.com (Harvey Robertson). On April 9, they came from chuin@netcom.com (Alan Parker); on April 14, from ellie@netcom.com (Elouise Frisbee); on April 19, from player@netcom.com (E Manley). Margaret once again promptly suspended all of these accounts. Many of these cancels were aimed at postings of something called "NOTS 34" by Keith Henson, who included the full text in a letter he sent to Judge Whyte in the Grady Ward case.
Return to The Church of Scientology vs. the Net main page.