It used to be lunch meat: The debate over spam

Weekly Corporate Growth Report, May 12, 2003 by Dolbeck, Andrew

In March, 45 percent of all e-mail sent was unsolicited advertising, or "spam," according to Brightmail, a San Francisco-based anti-spam company. That's an impressive increase from the mere 16 percent seen in January 2002. America Online says that the amount of spam directed at its customers has doubled since the beginning of the year and now approaches two billion messages a day - more than 70 percent of the total mail its users receive.

The Federal Trade Commission recently held a three-day forum on spam. Eileen Harrington, the FTC's director of marketing practices, stated, "There is a consensus that the problem has reached a tipping point. If there are not immediate improvements implemented across the board by technologists, service providers, and perhaps lawmakers, e-mail is at risk of being run into the ground." Most of the panelists at the forum agreed that some form of federal anti-spam legislation is needed.

One of the challenges facing any anti-spam legislation is protecting legitimate uses of email. Many businesses rely on email as an inexpensive alternative to traditional methods of advertisement. There are also companies that survive by providing e-mail marketing services to other businesses. Many of these companies rely on opt-in lists, which target e-mail users who have in some way agreed to receive advertising by e-mail. Alyx Sachs, a marketer for NetGlobalMarketing, contends that anti-spam legislation will make it harder to run a legitimate company.

The problem is that not all e-mail advertisements are legit, and legitimate advertising is easily lost in the flood of get-rich-quick schemes, pornography, and outright scams. Anti-spam legislation designed to outlaw such practices should significantly reduce the amount of spam - if it can be enforced. Fraudulent pitches are often sent under forged names and addresses, making it difficult to track down and prosecute the real senders.

E-mail scam artists employ a number of questionable tactics. Some use a technique called dictionary attacks, which involves alphabetically generating probable e-mail names and then attaching them to common service providers' addresses. E-mail addresses that work are then noted as valid addresses for spamming, or even sold to other marketers. Another trick is to make alterations in the subject line to evade filters looking to screen out questionable content. A filter that screens out "sex" for example, might miss "s*x" or "s-e-x." Internet service providers often monitor e-mail sent in volume. So spammers employ programs to randomly alter the subject line, so the systems won't detect a large number of messages sent with the same heading, even though the content is the same. Filtering programs that evaluate the text of the message can be foiled by embedded graphics that contain text.

Because e-mail wasn't designed to be traced, most systems allow users to disguise almost every line of an e-mail, including the "from" line and the "reply to" line - a practice known as "spoofing." George Johnson of the New York Times reported that his e-mail address, johnson@nytimes.com, was used as a return address by an anonymous spammer who operated under several first names combined with the surname Johnson. As a result, all the replies and failed-delivery notices from that round of spam came to his New York Times mailbox. He quickly received more than 750 such notices.

The state of Virginia recently passed a law assigning tough penalties for fraudulent email. The Senate is considering a bill called the Can Spam Act. The Act would allow companies to send unsolicited e-mail, but only as long as the message clearly identifies itself, clearly states what is being advertised, and offers the recipients a method to indicate that they do not want to receive further offers from the sender. Many legitimate companies already tailor their e-mails to meet these criteria. Asking the recipients to reply in order to remove their names from an e-mail list can be a problem, however, because many e-mail users believe that replying just verifies their e-mail address, increasing its value to marketers.

Another possibility, advocated by Senator Charles Schumer, would be to require all unsolicited commercial e-mail to include the term "ADV" at the beginning of the subject line. The Direct Marketers Association opposes this tactic, arguing that users or even service providers would filter out and discard all mail with the ADV label.

Spam may be good business for software makers. Network Associates, Symantec, Ipswitch Inc., and many others are launching anti-spam products. Microsoft is making e-mail and Internet filtering a major aspect of its MSN 8 advertising campaign. Content filtering will not provide an ultimate solution, however. Spammers have already proved to be very inventive is working around existing filtering programs, and will no doubt quickly learn to evade new ones.

Filters have also been known to hamper legitimate materials. Filters often work on lists of words that are commonly used in pornographic, racist, or other undesirable messages. The banned words, however, can also appear in more legitimate contexts. Several years ago, Rights Exchange Inc., a company that developed software for secure online financial transactions, ran into difficulties because computer filters read its name as Right Sexchange. More recently, Assembly Source, a company that sells industrial manufacturing equipment, was unable to register its email address with Microsoft because the proposed address assemblysource@msn.com - begins with "ass." Ray Everett-Church of the ePrivacy Group describes the problem as being "slave to technology's inability to accurately parse words."