Legislation Governing Online Drug Sale

Department of Justice – Ryan Haight

Oct 22, 2008
By: George Koroneos, Online Content & News Editor

If you had a drug dealer selling heroin out of your living room, chances are you would do something about it. That’s the predicament many Web hosting and domain registration companies have faced, as the number of illegal online pharmacies has spiked in the past few years.

President Bush, last week, signed into a law a bill that would give companies such as GoDaddy and Lunarpages the ability to remove Web sites of online pharmacies that are not registered as government-approved medication sellers. Under the new rules, if a Web site is making drugs available for sale in the US and they don’t comply with the statute, the hosting companies can shut the site down regardless of where the pharmacy is located.

“We are seeing so many pharmaceuticals—a dramatic increase over the last three years—online,” said Christine Jones, general counsel for GoDaddy, host to 31 million online domains.  “We were looking for a better solution than simply redirecting domain names for SPAM, which is all we could do in the past.”

The legislation came into existence after Rep. Bart Stupak (D-MI) became involved with a case in which ateenager overdosed on Vicodin. The drugs were obtained from an online pharmacy without a prescription. The Senate version of the bill made its way through the office of Sen. Dianne Feinstein (D-CA).

“We’re one step closer to ending the practice of rogue pharmacies on the Internet,” said Feinstein in a release. “We can no longer stand back and allow these outfits to sell highly addictive medications to anyone with a computer mouse and a credit card.”

Jones notes that there is no statutory obligation for an online pharmacy to receive verified Internet pharmacy practice sites (VIPPS) certification. “VIPPS is an extra layer of protection, but there is no requirement that says if you are not certified by VIPPS, you can’t sell drugs online,” she said. “We were looking for something that would make the sale of drugs without registration illegal. Just like child pornography is illegal and taken down immediately on the Web.”

By definition, the largest server providers also host the most illegal pharmacy sites. Last year, GoDaddy redirected 1,300 pharmacy related domain names for SPAM. In effect, if a spammer is sending emails from illegalpharmacy.com, and the host receives a SPAM complaint, the domain is taken away. GoDaddy wanted a tool that would easily allow the company to take a Web site offline without having to buy and test the drugs, get a prescription, or make people see a doctor.

“[Under the old rules] we couldn’t take your content away, but you are not allowed to use domain names that are registered to GoDaddy,” Jones said. “We weren’t allowed to take the underlying Web site down, because they weren’t doing anything wrong.”

Even though the registration period isn’t for another six months, GoDaddy has taken a number of URLs that it knew to be violating the prescription rules and have redirected them.

“A lot goes into that law enforcement investigation before a site can come down—we would like to squash that a little earlier,” Jones said. “I always try to encourage people, when they come across a shady site, figure out who the hosting company is and send an email to their abuse department. We rely on those notices to do our investigation.”

Open Congress – Ryan Haight Online Pharmacy Consumer Protection Act of 2008

Official Summary

4/1/2008–Passed Senate amended. Ryan Haight Online Pharmacy Consumer Protection Act of 2008 – Amends the Controlled Substances Act to prohibit the delivery, distribution, or dispensing of controlled substances over the Internet without a valid prescription. Exempts telemedicine practitioners. Defines “valid prescription” as a prescription that is issued for a legitimate purpose by a practitioner who has conducted at least one in-person medical evaluation of the patient. Adds definitions to the Controlled Substances Act relating to online pharmacies and the issuance of prescriptions over the Internet.
Imposes registration and reporting requirements on online pharmacies.
Requires an online pharmacy to:
(1) display on its Internet homepage a statement that it complies with the requirements of this Act;
(2) comply with state laws for the licensure of pharmacies in each state in which it operates or sells controlled substances;
(3) post on its Internet homepage specified information, including the name, address, and telephone number of the pharmacy, the qualifications of its pharmacist-in-charge, and a certification of its registration under this Act; and
(4) notify the Attorney General and applicable state boards of pharmacy at least 30 days prior to offering to sell, deliver, distribute, or dispense controlled substances over the Internet.
Authorizes the Attorney General to issue a special registration under this Act for telemedicine practitioners.
Increases criminal penalties involving controlled substances in Schedules III, IV, and V of the Controlled Substances Act. Authorizes states to apply for injunctions or obtain damages and other civil remedies against online pharmacies that are deemed a threat to state residents.
Requires the U.S. Sentencing Commission, in determining whether to amend or establish new sentencing guidelines to conform the guidelines and policy statements to this Act, to consult with the Department of Justice (DOJ), experts, and other affected parties concerning which penalties for scheduled substances should be reflected.
Requires the Drug Enforcement Administration (DEA) to report to Congress after the enactment of this Act and annually for two years after such initial report on:
(1) the foreign supply chains and sources of controlled substances offered for sale without a valid prescription on the Internet;
(2) DEA efforts and strategy to decrease such foreign supply chains; and
(3) DEA efforts to work with domestic and multinational pharmaceutical companies and others in combating the sale of controlled substances over the Internet without a valid prescription.

GoDaddy Is Cracking Down on Rx Pharmacies

I have over 350 pharma domains registered with GoDaddy. Never had any problem with them. In fact, they offer me $8 domain registrations/renewals, free domain privacy and SSL certs for 12 bucks a pop. That’s hard to beat.

  • If you’re not violating the GoDaddy TOS, you have nothing to worry about. Posted elsewhere,
  • “If a Registrar receives information of an illicit pharmacy site sponsored by them from any consumer and does not investigate and terminate, that Registrar is now aiding criminals.
  • If a Registrar continues to accept payment from the domain owner after being notified, they are then receiving money from organized crime.” Get listed on the Sorbs Blacklist and you lose your domain.
  • If you’re using a domain registered with GoDaddy for pharma spamming, (or even worse a domain HOSTED by GoDaddy,) you will lose your domain. Period.

Get caught peddling controlled substances like steroids or phentermine and you’ll lose your domain. Use a domain that includes a trademarked term to divert visitors to pharmacies pushing unapproved generics and you’ll lose your domain. Don’t even try registering or hosting your generic Viagra domain at GoDaddy. It WILL be shut down.

Department of Justice – Ryan Haight

PC World – Online Thugs Attack Good Guys

Posted In: Publications
Tue, Sep 11th, 2007

The good guys are taking a hit in the ongoing online war between the thugs who profit from phishing and malware, and those who work to stop them.

For two weeks, Web sites like CastleCops.com, which offers help to those hit by malware and also actively works to shut down malicious Web sites, have been under attack. In what’s known as a distributed denial of service, black hats are flooding CastleCops with a barrage of garbage data in an attempt to overwhelm the site and knock it offline.

“It’s the folks who are out there in the trenches getting hit,” says Paul Laudanski, who founded CastleCops five and a half years ago

Attack Spreads

When the attack on CastleCops.com began on August 29, Laudanski says, the site went down for a few hours as he scrambled to apply countermeasures. His site came back up, but the attack soon spread to other helpful sites such as 419eater.com, fraudwatchers.org, scam.com, scamfraudalert.com, and scamwarners.com. Most of these sites are currently unresponsive.

When the hosting provider for another site, aa419.org, dropped the site because the attack became too much for the provider, CastleCops gave aa419.org a home. CastleCops went down again under the combined attack, but is back up again.

The sites are all being hit by botnets, corralled networks of malware-infected computers that can be issued commands by a central controller, or botherder. Botnets are most often used to send money-making spam, but they can also launch denial-of-service attacks where each infected PC sends a steady stream of traffic at a victim site. CastleCops is shouldering the brunt of 20,000 bots as of today, and more than 1,000 additional bots join the fray each day.

Mystery Motive

Laundanski says he and others who work at these sites, many of which are not-for-profit, are still unsure about the attack’s rationale. And he’s likewise uncertain about whether it’s one group or many behind it all. He’s been able to gather some details, but doesn’t want to share them while the threat continues and let his attackers know what he’s been able to find out.

But Paul Sop, CTO of Prolexic, a company that defends clients against DDoS attacks, says “the prevailing street theory is that these guys are having an effect.” Their advice is helping malware or phishing victims, and their investigations are helping to shut down criminal operations

“So the botnet guys are targeting them,” he says.

Security sites, including CastleCops, have been targeted in the past, but attacks are on the rise, Sop says. In the past five months, he says, there has been an increased focus on attacking organizations on the front lines who try to fight back against the crooks.

Strengthened Resolve

But according to Laudanski, who has started a new online forum documenting the ongoing battles, the attacks may backfire.

“The criminals are in it for the money,” he says. “It’s a huge business for them. [But] we’re in it for the feeling that we get being on the side of right.”

So this assault shows that “these sites are definitely doing something right,” he says, “because we’ve got the attention of these scammers. It gives us greater resolve.”

Spammers Launch Denial of Service Attacks Against Antispam Sites

Antispam sites that fight back against phishing scams have been attacked with denial of service attacks launched by spam botnets. Antispam vigilantes believe that the Storm worm is behind the onslaught.
By Ryan Paul | Last updated 2 years ago

Antispam community sites that help combat phishing scams and spam are being targeted with denial of service attacks by malware botnets presumably operated by spammers. The trend was reported last week by antispam site SpamNation.

SpamNation believes that the denial of service attacks are being launched by the Zhelatin gang, the same group that is thought to be behind the rapidly growing Storm worm botnet. According to SpamNation, the botnet operators are selling denial of service attacks. “When the firehose of the Zhelatin botnet gets turned on your site, it doesn’t mean that it’s the gang themselves who have singled you out for attack,” says SpamNation. “It’s more likely that the attack has been commissioned by one of their customers. In the same way that a customer can order a stock spam run, they can request a DDoS attack.”

Sites that have been targeted include 419Eater, ScamWarners, CastleCops, scam.com, scamfraudalert.com, and Artists against 419.

CastleCops, which is currently back up, has established a denial of service forum to provide information about the ongoing attacks and facilitate discussion. System administrators are also sharing blacklists of IP addresses and netblocks that represent botnet zombie systems.

The distributed computational power of the Storm botnet is thought to have surpassed that of virtually all major supercomputers. The rate at which the botnet is evolving is extremely unsettling, and one can only wonder what kind of sites will be targeted with denial of service attacks as it continues to grow in size. Let’s hope it doesn’t evolve too quickly; the last thing we need is a self-aware spam botnet. “I’m afraid I can’t let you block that spam message, Dave.”

Source: arstechnica.com