Posted on 28-6-2002

Spam It!
Ed from NY Times, June 27, 2002

"I got the Viagra," calls out one 20-something employee as he clicks to
create a simple filter. "I need help on the breast enhancement," announces
another. Spammers are like fruit flies. They multiply. They are elusive.
Worst of all, they evolve quickly. The most aggressive spammers have become
very sophisticated, constantly varying subject lines, "from" addresses and
body text, and more sophisticated, and more prolific. These days, more and
more junk e-mail is finding its way into In boxes.

Brightmail says the volume of spam it encounters has almost tripled in the
last nine months. The company adds that 12 to 15 percent of total e-mail
traffic is spam; a year ago, that figure was closer to 7 percent.
Brightmail, which maintains a network of In boxes to attract spam, now
records 140,000 spam attacks a day, each potentially involving thousands of
messages, if not millions. Statistics like these are supported by anecdotal
evidence from computer users, who report that they are seeing more unwanted
e-mail every time they log on. Hounded by spam, some computer users have
simply abandoned e-mail addresses.

No one knows precisely why spamming has increased so much. One reason may
be that it is an inexpensive form of marketing favored in a slumping
economy. Another may be that it is relatively simple to do — it is not much
harder to send one million e-mail messages than it is to send one. But some
analysts say that the increase may also result, paradoxically, from the
efforts to curb spam. A kind of arms race may have developed, those
analysts say: the more efforts are made to block unwanted e-mail, the more
messages spammers send to be sure that some will get through. Whatever the
reasons, individual complaints about e-mail are echoed by Internet service
providers, some of which say that 50 percent of incoming e-mail traffic is
spam.

Consumer advocates and politicians are complaining too, and proposing new
laws to fight spam. Governmental agencies are also announcing new
initiatives in the battle. Clearly, spam is a part of electronic
communications that everyone loves to hate. But it is also something that
no one, it seems, can do much about. Here are the reasons.

Ideally, consumer advocates want the spam equivalent of the 1991 federal
Telephone Consumer Protection Act, which prohibited prerecorded
telemarketing calls and junk faxes. The trade commission was also given
power to enforce the legislation. A broad anti-spam law has been approved
in Europe. On May 30, the European Parliament passed a ban on unsolicited
commercial messaging. Electronic marketing can be aimed only at consumers
who have given prior consent.

In contrast, more than a dozen spam-related bills have been introduced into
the US Congress over the last two years, and most of them have languished.
Of the handful that have made progress, the most recent is the Controlling
the Assault of Non-Solicited Pornography and Marketing act (a contorted
title that yields the acronym Can Spam), which was unanimously approved by
the Senate Commerce Committee last month. The Can Spam bill would, among
other things, let the F.T.C. impose civil fines up to $10 per unlawful
message, require valid "remove me" options on all e-mail and authorize
state attorneys general to bring lawsuits. Now it must be voted upon by the
full Senate, and two other independent spam bills are moving slowly through
the House of Representatives. But interest groups are lobbying to tone down
the strongest aspects of spam legislation.

Those lobbyists are not spammers. They are some of the country's largest
corporations and commercial associations: Citicorp, Charles Schwab, Procter
& Gamble , the National Retail Federation, the Securities Industry
Association and the American Insurance Association. The groups argue that
many of the bills would unfairly restrict e-mail marketing and put
electronic commerce at a disadvantage. "We would like the bill narrowed so
only pornographic, fraudulent and deceptive spam are targeted," said John
Savercool, the vice president of federal affairs for the American Insurance
Association. "We think that is where the consumer angst is."

Litigation

With little happening in Congress on anti-spam legislation, 25 state
governments have taken the lead and passed a variety of spam-related laws.
They range from Delaware's 1999 outright ban on unsolicited commercial
e-mail to more indirect limitations. Most states ban false return e-mail
addresses, require "remove me" provisions or demand labels on sex-related
messages. (New Zealand parliament seems to have not notices the spam
problem, zero response from Wellington - Ed.) But laws, whether federal or
state, may serve as a deterrent only when they are enforced. And
enforcement of these state anti-spam laws is more the exception than the
rule. Despite hundreds of thousands of consumer complaints to state
agencies, only Washington State has filed a lawsuit based on anti-spam
legislation. Other states that do not have anti-spam laws, like New York,
have sued or charged spammers by using laws on deceptive marketing and
computer hacking. The cases are pending.

Legal experts say the problems with local spam laws are manifold. First of
all, most do not prohibit spam. "Even if the laws were enforced
effectively, they wouldn't address most of the spam problem," said David E.
Sorkin, a professor at the John Marshall Law School in Chicago who runs a
site called Spamlaws.com. "The implied message is that if you weren't lying
about it, it would be O.K. to spam people."

Second, spam transcends state (and national) boundaries, and many of the
state laws stipulate that they take effect only if a spammer can
"reasonably know" that the recipient is a resident of a particular state.

Third, spammers are elusive. Lawsuits generally need to nail down a
physical presence to proceed. When the F.T.C. sent warning letters to
spammers with false "remove me" options, more than 20 percent of the
letters came back because the addresses registered with the domain names
were false. Telemarketers are easier to identify because telemarketing is
expensive and as a result, such companies need assets. All a spammer needs
for business is a computer, an Internet connection and an inexpensive CD
containing spamming software and tens of millions of e-mail addresses.
"Most of the spammers are not wealthy people," said Stephen Kline, a lawyer
for the New York State attorney general's office. "It's tough if you are
going after someone with very few assets to get restitution for consumers
or justify the costs."

So most spam-related lawsuits have been brought by companies and
individuals motivated more by a sense of a crusade than by the prospect of
a financial reward. In March, Morrison & Foerster, a California law firm,
filed a lawsuit against Etracks, an e-mail marketer, for sending e-mail to
its servers. Etracks says that it works with permission-based marketing, a
contention that Morrison & Foerster disputes.

Some I.S.P.'s, including CompuServe and AOL, have filed suit against
spammers to prevent them from sending unsolicited e-mail to users of those
services. But using lawsuits to combat spammers is like trying to catch
swarming fruit flies by hand. For every one you manage to catch, there are
10 more undeterred ones pestering you. (AOL sells email addresses of its
users, so any talk of anti-spam rings hollow - Ed.)

Technology

To date, the most effective weapon against spam is technology. "Spam
requires a technology solution because it is a technology problem," said
Ken Schneider, chief technology officer at Brightmail. But even technology
is limited, since spam is e-mail and e-mail is designed to flow easily.
Only 5 percent of all enterprises will be able to filter 90 percent of spam
in 2002, said Joyce Graff, research director at Gartner Research.
Businesses have tried to throw up all types of defenses. Many reject mail
coming from computers that are known to have been hijacked for spam. Some
I.S.P.'s reject e-mail sent in bulk. That often results in the rejection of
legitimate noncommercial messages sent to addresses on mailing lists. Other
technological approaches limit e-mail to preapproved senders or senders who
respond with a password — approaches that slow down the transmission of
e-mail. Users can also buy personal In box protectors. Brightmail, which
has one of the most sophisticated services, says the best spammers are
always a step ahead of its defense mechanism. They evade Brightmail filters
by randomizing the characteristics that filters look for. "It's very
difficult to fight," said Mr. Long, the war-room worker. "You get
entrenched fighting it one way, and they go put a new tool against you."

Spam may be an inescapable element of online existence. "Is spam going to
be something we will all learn to live with, like increased airline
security?" asked Enrique Salem, chief executive of Brightmail. "Or will it
disappear?" For spam to disappear, a combination of coordinated
international regulatory action, aggressive enforcement, software and human
oversight is needed, Mr. Salem said. The bad news is that until that magic
combination comes about, spam will continue to clog In boxes. The good news
is that it could help you look younger, feel more virile, become debt-free
and get a college degree at home. Really...