Opening Pandora’s inbox

Aug 10th 2005
From The Economist Global Agenda

Microsoft has reached a settlement with one of the world’s leading spammers which includes a payment of $7m to the software giant. Despite legal and technological challenges, spamming is still a big problem. And a new form of the scourge could prove even more costly to the unwary

FOR overweight lovers of pornography in need of a cheap loan or a “boost”, the offers of slimming pills, Viagra, smut and the like that flood into e-mail inboxes around the world are a positive boon. For most consumers and businesses, however, “spam” has grown over the past few years from a mere nuisance into a costly and time-consuming threat. On Tuesday August 9th, business fought back. Microsoft’s case against Scott Richter ended in victory for the software giant after the “spam king” agreed to pay $7m to settle charges relating to a lawsuit filed in 2003 against his internet firm, OptInRealBig.

Microsoft alleged that Mr Richter’s firm had sent up to 38 billion unsolicited commercial e-mails a year, offering anything from loans to herbal remedies. Once described as the world’s leading spammer, Mr Richter claims that his firm has since cleaned up its act and now only sends offers to customers that want them. Microsoft was joined in the action by Eliot Spitzer, who for once took the side of big business (albeit in a battle with another, more unpopular business). The software giant and New York’s crusading attorney-general are not alone in wanting to stamp out spam. Other big technology firms, internet service providers, affected companies and governments have all taken action of various kinds against spammers. There are even some suggestions that the battle against unwanted e-mail is finally being won.

The volume of spam increased alarmingly over much of the past few years. In 1997, the world’s e-mail users could expect on average one unsolicited spam message a week. By the end of 2000, spam accounted for some 10% of global e-mail traffic. Steadily that proportion increased to a high of an astounding 95% in July 2004 (see chart), according to MessageLabs, a message-security firm. Since then, the level has fallen to just below 70%.

But though some may count this as a victory of sorts, spam still accounts for a greater share of worldwide e-mail traffic than it did when federal anti-spam regulation was introduced in America—where much spam originates and is received—some 18 months ago. Despite Bill Gates’s declaration in 2004 that spam would soon be a thing of the past, it is clearly a vast problem that is not going away.

And it is costly as well as inconvenient and annoying. Ferris Research, a consulting firm, estimates that spam will cost American businesses alone $17 billion this year in lost productivity and in spending on anti-spam measures; sending spam, on the other hand, is virtually costless. America Online (AOL) says that at any time between a third and two-thirds of its server capacity is taken up by spam (though the firm noted a decline in 2004). Some spam messages contain computer viruses that wreak havoc with the recipients’ hard drives. Others contain scams that cost gullible readers in more embarrassing ways.

Mr Richter’s case is only the latest in a series of prosecutions that have led to fines and prison sentences for junk e-mailers in America and elsewhere. Microsoft has joined forces with AOL, Yahoo! and EarthLink to bring legal actions against spammers. In the past two years, Microsoft has filed over 100 lawsuits in America, and either initiated or supported legal action against spammers in 30 cases abroad, of which it has won or favourably settled over half. And sentences for spamming can be stiff. In April, Jeremy Jaynes, considered among the world’s top-ten spammers, got a nine-year prison sentence in America for using false e-mail addresses and aliases to send mass e-mails (though the sentence was suspended pending an appeal).

But spammers are an elusive bunch. Following the introduction of America’s anti-spam CAN-SPAM Act in January 2004, junk e-mailing fell briefly but then shot up again (see chart). Some spammers, acting illegally by sending messages via third-party “proxies”, simply moved abroad. Furthermore, the act gave spammers a let-out: its authors, lobbied hard by legitimate marketing companies, agreed that spamming could still be deemed legal as long as recipients were able to remove themselves from mailing lists, and senders did not mislead them about the origin of the mail. In Europe, too, new measures have been of limited help. The European Union introduced tougher legislation shortly before America. This required explicit consent from recipients before spam could be sent but has proved largely ineffective as a deterrent.

As a result, internet users have been taking matters into their own hands using blocking technology, which is improving all the time. Around 90% of all spam is caught by filters these days. But spam still clogs servers, to the chagrin of internet service providers and IT departments.

Phishing for victims

The recent decline in the amount of spam may just reflect a realisation on the part of spammers that they need to be more selective now that filters will trap the most obvious unsolicited offers. And a troubling development is the increased incidence of “phishing”, a form of fraudulent spamming that can be extremely costly to victims. Phishers send out millions of e-mails in an attempt to steal personal and financial-account details from unsuspecting dupes. These e-mails purport to come from reputable businesses and contain links to websites where recipients are asked to divulge bank and credit-card details. The fraudsters can then use this information to steal cash from their victims. One recent attempt mimicked eBay’s website. Another, similar fraud involves spam e-mails carrying hidden software that sends details of the recipient’s computer use to criminals, often using key-logging software that notes passwords or keyed-in bank details.

Despite the modest successes in the war on spam, it is here to stay. The type of cross-border legal action that is necessary to rope in spammers is notoriously hard to organise, and jurisdictions that are willing to turn a blind eye to spammers will be impossible to police. Technology may yet provide an answer beyond blocking technology. Microsoft and other big technology firms are currently tussling over the best standard for authentication technologies that verify the origins of e-mails and might provide added protection in the future. They have their work cut out. Old-style spamming may, perhaps, be coming under control. But for the enterprising miscreant, spamming-based computer crime is a growth industry.

Copyright © 2005 The Economist Newspaper and The Economist Group. All rights reserved.