international war on spam, The

Information Management Journal, Sep/Oct 2003 by Swartz, Nikki

Governments, businesses, and consumers worldwide agree that unsolicited e-mail advertising, or spam, must be controlled, but their methods of doing so differ

Currently, analysis estimate, unsolicited bulk e-mail advertisements - "spam" - accounts for almost 50 percent of all e-mail sent worldwide - up dramatically since 2001 when the sometimes offensive, deceptive, and fraudulent e-mails comprised just 8 percent of all e-mails. The U.S. Chamber of Commerce estimates that businesses lose about $10 billion a year in time and productivity, bandwidth costs, and money spent on anti-spam tools. Ferris Research estimates that spam costs European Union (EU) businesses $2.5 billion annually.

Worldwide, businesses and individuals are spending an increasing amount of time and money to clean up e-mail boxes. In addition, spam threatens to stifle some of the major benefits of services such as e-mail and e-commerce, as well as reduce consumer confidence in the Internet.

"Spam: The Silent ROI Killer," a report by independent firm Nucleus Research, found that spam costs businesses $874 per employee annually. The figure is based on an hourly pay of $30 and a work year of 2,080 hours. Interviews with employees and IT administrators at 76 U.S. companies also revealed that

* Companies lose approximately 1.4 percent of each employee's productivity each year due to spam.

* The average employee receives 13.3 spam messages each day.

* Employees spend, on average, 6.5 minutes per day managing spam.

* For every 72 employees, companies are losing the productivity of one due to spam.

The cost of spam is high and is expected to get higher. The Radicati Group estimates that a company with 10,000 users and without anti-spam protection will spend an average of $49 per e-mail box annually processing spam messages in 2003. The research firm's study "Anti-Spam Market Trends, 2003-2007" predicted that dealing with spam e-mails will cost companies around the world $20.5 billion this year and $198 billion by 2007.

Spam producers use databases of e-mail addresses collected from public Web sites, create mail lists, or purchase subscriber lists. "Spammers" modify subject lines, insert hidden text into the message body, and hide their true e-mail address to elude anti-spam filters. Traditional technology is more effective at blocking previously sent messages but it is more difficult to identify new spam or viruses.

While governments, businesses, and consumers worldwide agree that fraudulent spam e-mails must be eradicated, their methods of solving the problem differ. The United States is seeking "opt-out" legislation, while the European Union has established "opt-in" laws. However, their goal is the same and, therefore, the global nature of the problem means that cooperation is imperative.

U.S. Anti-Spam Action

Federal legislators have favored an "opt-out" approach to spam, meaning that when recipients request to be removed from mass e-mail lists, marketers must delete their e-mail addresses and not send them any further messages or face fines or jail time. Under most of the adopted and proposed legislation, legitimate businesses may still send bulk e-mail advertisements to customers.

U.S. businesses have a First Amendment right to distribute unsolicited e-mail advertisements, but state and federal governments, responding to consumer complaints, now are investigating anti-spam laws that will help reduce the daily torrent of fraudulent e-mail sent to consumers. Thirty-eight states now have laws regulating some aspect of spam. In Virginia, for example, the penalty for sending more than 10,000 unsolicited e-mail messages in one day is a prison sentence ranging from one to five years along with the relinquishment of any profits and assets related to those fraudulent activities.

In June, the Senate Committee on Commerce, Science, and Transportation passed S. 877, Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM), introduced by Sen. Conrad Burns (R-Mont). The bill would allow consumers to opt-out of unwanted commercial e-mail messages and impose penalties on those who violate the act by deliberately falsifying their identities or the content of their messages. Once notified, marketers would be prohibited from sending any further messages to the consumer. The measure would require all unsolicited marketing e-mail to have a valid return e-mail address so recipients can opt-out.

In addition to making it easier for consumers to be removed from mass e-mail lists, the bill would enable Internet service providers (ISPs) to bring action to keep unlawful spam from their networks. The legislation contains strong enforcement provisions allowing the Federal Trade Commission (FTC) to impose up to $3 million in civil fines on those who violate the law. State attorneys general would be given the ability to bring suit on behalf of citizens who have been victimized by unscrupulous marketers.

The bill calls for increased penalties for certain techniques commonly used by spammers, including "dictionary attacks" (the establishment of numerous e-mail accounts to make spam more difficult to track and block) and the hijacking of other computers or computer networks to send or relay spam. Another provision clarifies that when a recipient asks to be removed from a sender's mailing list, the sender may not share or sell that recipient's e-mail address to a third party. The measure includes a modified preemption rule to allow states to continue to impose and enforce strong laws against falsity and deception in spam, while still ensuring national standards for compliance with the law.