Spam overwhelms e-mail systems
Before Vicki Coelho lets her nine-year-old daughter read her e-mail, she screens it. Ms Coelho, the sales and marketing manager of Internet service provider (ISP) North Rock Communications, wants to prevent her daughter from reading the junk mail sent to her address which advertises, among other things, pornographic web sites.
"We've noticed in the past six months a lot more unsolicited mail," said Ms Coelho, who receives about ten pieces of junk mail each day in her own inbox.
Logic Communications' chief executive officer, Jeff Hamill, said his company has also noticed an increase in junk mail volume during the past 12 months, although he did not give statistics. Of the 500 or so messages Mr. Hamill receives each day, about ten percent are junk mail (the rest include several regular mailings to which he subscribes).
In addition to the increased volume of junk mail, Mr. Hamill said Logic had uncovered instances when corporate customers' e-mail servers had been used to by mass e-mailers to relay junk e-mail and disguise their identities. He said the company had never caught any of its own subscribers purposefully sending junk mail.
Statistics indicate that the volume of junk mail has grown and analysts expect the growth to continue. Brightmail, a company which provides spam-filtering services for ISPs, recorded 683,579 spam attacks on its network in May 2001. A year later, the company detected 4.3 million - a six-fold increase.
Jupiter Media Matrix, an Internet research firm, estimates that this year, e-mail users will receive an average of 700 unsolicited e-mail messages trying to sell them something. The firm expects the figure to balloon to 1,600 messages a year by 2006.
In Bermuda, Ms Coelho suggested that mass e-mailers had perhaps "discovered" the .bm domain that comes at the end of most local e-mail addresses.
Spam e-mail is often used to market pyramid schemes, pornographic web sites, bulk e-mail software and services, stock offerings for unknown start-up companies, health products and pirated software, according to the Coalition Against Unsolicited Commercial Email (CAUCE), one of many non-profit groups formed in response to the proliferation of unsolicited e-mail advertising. The technique is also often used to plug degrees from unaccredited universities, low-interest credit cards and mortgages to get consumers out of debt.
Mr. Hamill said as the Internet's penetration has increased, mass e-mailing has become a more attractive marketing method because it allows companies to promote themselves at the fraction of the cost of other mediums and exclusively to their target market - people connected to the Internet.
Companies who use bulk e-mail are also having an easier time finding e-mail addresses. Mr. Hamill said that as people have become more familiar with the Internet, they have become more comfortable with giving out their e-mail address online, whether to merchants or to sign up for a newsletter. These companies might sell their lists to spammers, especially if they go bust (the practice prompted the creation of companies which certify the privacy practices of websites).
The proliferation is also due to the increasingly sophisticated techniques of spammers, which include employing software to scour the Internet for e-mail addresses left on newsgroups and e-mail generator programmes. The generator programmes come up with common names and add them to known domain names, like ibl.bm, to construct e-mail addresses and hope that the addresses are valid. Some invariably are.
Attempts to get off bulk e-mail lists are usually fruitless. Although most e-mails include an e-mail address to which users can send unsubscribe requests, many of the e-mail addresses are falsified - in a study of 215 spam e-mails by the United States Federal Trade Commission, testers found that 63 percent of the addresses were invalid and rejected by e-mail servers, against FTC regulations which do not prohibit remove requests. And when the e-mails do go through, users may actually end up validating their address or getting it added to other bulk e-mail lists. In a separate experiment, one user set up a new e-mail address to send an unsubscribe request in response to piece of junk mail he had received at another address. It was not long before the new e-mail address was assaulted with more spam.
At the Global Internet Project Conference in Arlington, Virginia last month, technology managers and executives told Computerworld magazine that spam "imperils the Internet" and is "out of control."
It is more than a simple annoyance for users who must filter through their e-mail to determine what, if anything, is legitimate correspondence. By consuming bandwidth, or the connections that form the Internet, it slows down online traffic.
Some ISPs, including Logic, have installed filtering software to reduce the amount of junk mail sent to customers' inboxes. Mr. Hamill said that about three months ago, the company subscribed to the Mail Abuse Prevention System's Realtime Blackhole List software.
The software collects IP addresses - combinations of numbers used to identify every computer on the Internet - from which spam has originated and blocks those computers from sending e-mail to its member ISPs, regardless of the return e-mail address, which can easily be faked. To prevent clogging, Logic installed a second inbound mail server to operate the software and forward unfiltered mail to the main server, which holds mail destined for distribution to customers.
Mr. Hamill said that maintaining the anti-spam software, along with wasted bandwidth and man-hours, costs the company thousands of dollars each year. It also was part of the reason the company removed an online e-mail directory of its subscribers' e-mail addresses a few years ago.
Ms Coelho did not say whether North Rock has taken measures to filter spam from its system. Cable & Wireless, which provides Internet access for businesses, said it had not received customer complaints about spam, but it was aware of the problem and was upgrading its e-mail platform to a system capable of filtering junk mail. A spokesman for TeleBermuda International sad the company had not received any customer complaints about e-mail and had no e-mail filtering procedures in place.
According to a survey conducted in the US by the Gartner Group, 74 percent of users believe their ISPs should be responsible for junk mail problems. But messages invariably get through, and Mr. Hamill suggested measures customers could take to reduce the flow of junk mail into their inboxes. One such measure is using software which filters e-mail by searching for certain words in the message and blocking e-mail addresses that have sent spam before, although the effectiveness of these techniques is limited.
"It's almost like guerrilla warfare," Ed Plaskon, product director for AT&T WorldNet Services, told ABC News. "We come up with solutions (to filter spam), and (spammers) work around that."
Some of the techniques include using different return e-mail addresses for separate mass mailings or even using the recipient's e-mail address, as if somehow they had sent themselves an e-mail. They also compose subject lines which appear legitimate, like "For your information", instead of blatantly commercial pitches which filtering software might recognise or customers will automatically ignore. In the body of their e-mail messages, some junk mailers include spaces between the letters of certain words which might otherwise be picked up by filters.
More sophisticated systems, like ClicVu Inc.'s Spamex, allow Internet users to create disposable e-mail addresses which they can use when an e-mail address is required to obtain information online and shut down when the spam starts piling in. The service costs $9.95 a year.
One service, SpamNet, was founded by one of the developers of Napster and works on the same principle as the music sharing service. Consumers download a piece of software which allows them to record which messages they received were junk and share that information with other users, whose e-mail programmes automatically filter out those messages.
But the information sharing between end users - the system's strength - is also its main weakness. Internet users have varying tolerance levels for junk mail, and while some may welcome mailings from Amazon.com about new book releases, others might consider such messages junk e-mail, even though they likely consented to receiving them. If enough users label such a message as junk, no one using the system will receive it.
(According to Mr. Hamill, a handful of customers have even called to complain about bulk e-mails from Logic's customer service division - usually announcing service interruption early on a Sunday morning - which they never asked to receive. Logic will remove a customer from the list if they request it.)
Spam has caught the attention of lawmakers. In Bermuda, the Electronic Transactions Act prohibits unsolicited e-mail and requires e-commerce providers to log complaints about junk mail. In the US, about two dozen states have outlawed unsolicited commercial e-mail, and last month federal legislation was proposed which would fine spammers as much as $30 for each address. The European Parliament signed off guidelines that prohibited spam, although the directive, which is not binding, will not become law until each member state approves it.
In New York, where there is no anti-spam legislation, the state's attorney general invoked computer hacking and deceptive marketing legislation when he filed a suit against MonsterHut.com, an e-mail marketing company. The suit claims that the company misrepresented its e-mail lists as opt-in and sent 500 million unsolicited commercial e-mails - government officials claim that the company's lists are only partially opt-in and that more than 750,000 people had asked to be removed from MonsterHut's lists. Although the MonsterHut's ISP, PaeTec, was able to disconnect the company for breaching the terms of service, which prohibit spamming, the attorney general wants to make sure that MonsterHut will not be able to continue sending unsolicited commercial e-mail with a more lenient ISP. For some ISPs, providing service to bulk e-mailers is the core of their business.
"Use Bulk Email Superstore e-mail software and services to keep new visitors coming to your site, as well as keeping existing customers involved and informed," reads one website. The company calls itself "bulk e-mail-friendly" and hosts websites behind alias addresses which disguise the identity of the owners and the real address of the server, thus safeguarding against retaliatory attacks by disgruntled hackers after a bulk e-mail is sent out. The lax terms of service come at a price, though - $995 a month, several hundred dollars more than most hosting packages. For an additional $39.95 a month, customers can receive 1 million e-mail addresses for their bulk e-mail campaigns.
But even if legislation shuts such companies down, observers are sceptical about the overall effect it will have because a lot of junk mail traffic originates from locations outside of the US, or could easily move there. According to a report in the Washington Post, "more than a few" corporate administrators have attempted to curb spam traffic by altogether blocking e-mail that originates from computers outside of the US.
Complaints registered with foreign ISPs whose clients send spam are often ignored because the companies lack the resources or interest to fix the problem.
