Information about SPAM

Have you been spammed today? If not, you're one of the lucky (and increasingly rare) individuals who can make it through an entire day without discovering that a stranger has soiled your Inbox. The barrage of unsolicited bulk e-mail (UBE) spewed daily by unscrupulous hucksters is reaching epidemic levels, and all indications are that it's going to get much worse before it gets any betteras thousands of new netizens join the Internet community daily.

 

What is spam?

"Spam" is a term coined by the Internet community long ago to describe the mass posting of articles to USENET newsgroups. Whether they were posted multiple times to a single newsgroup, or posted once to dozens of different newsgroups, spam simply means a lot of copies of the same message sent all over the Net.

The name was adapted from a Monty Python skit, in which a dining couple peruses a restaurant menu. Every item on the menu has spam in it. Despite their complaints, the waiter insists that the kitchen will not spare the spam. Every time the word "spam" is spoken, a trio of burly, helmeted Vikings at the next table begins to sing the praises of spam at the top of their lungs, drowning out all other conversation.

This is exactly the effect that spammed messages have on both USENET and e-mail, and why spam is abhorred by everyone . . . except those who send it. Spam overwhelms and drowns out newsgroup conversations by making legitimate posts difficult to find and causing real articles to expire more quickly in order to make room for incoming spam.

With intentionally misleading subject lines such as "Look at this!" or "Am I too late?" e-mail spam infiltrates your legitimate mail, cluttering up your Inbox with advertisements for pornographic Web sites, illegal pyramid-scheme chain letters, discount computer parts or, worst of all, e-mail addresses and tools so you can become a spammer yourself. Regardless of the content, UBE is repugnant simply because it is an unsolicited invasion of your privacy, and constitutes advertising to you at your own expense.

Content is not the issue. Whether the spammer is selling long-distance telephone service, porn, or eternal salvation (there are almost as many missionaries in my Inbox as pornographers), it's the method that is condemnable, not necessarily the message.

 

Spam is abuse of the Internet.

Ignoring for a moment the annoyance factor, junk e-mail can do far worse than irritate users and give system administrators conniptions. UBE congests the Internet's data pipelines, slowing the delivery of legitimate mail and the loading time of Web pages for all Internet users. The vastly increased traffic generated by spammers can sometimes reach levels that cause e-mail servers and entire Internet Service Providers (ISPs) to crash. Estimates vary, but large connectivity providers (AT&T, UU.NET, GTE, AOL, etc.) have claimed that up to 30 percent of their daily traffic is unsolicited e-mail.

 

Spam is theft.

Spam costs us all. UBE increases costs for ISPs, who must purchase additional equipment to handle the onslaught. These costs are frequently passed on to customers in the form of increased monthly fees. Additionally, some users may incur extra costs while waiting for their computer to download unwanted
e-mail.

Spam is also theft of the most important commodity we have: our time. Since I started keeping track earlier this year (out of a sick fascination with how much spam I was receiving), I've counted 554 of these unwelcome messages. This is mild compared to some reports in the newsgroup news.admin.net-abuse.email, where System Administrators and frustrated users share tips and information about spammers and spam fighting.

Unsolicited faxes are already illegal, because in this case the cost-shifting to the recipient is obvious, whereas the time it takes me to delete and respond to unsolicited mail is less easily tractable. New Jersey Representative Chris Smith introduced a bill in the House titled "Netizens Protection Act of 1997," which would amend the junk fax law to also prohibit unsolicited e-mail advertising; however, the Direct Marketing Association is lobbying hard against it, and succeeded in getting it shelved during the last legislative session.

 

Spammers cloud the issue.

The most frequent argument that spammers use to defend their inequitable consumption of network bandwidth is the first amendment right to freedom of speech. This is disingenuous for many reasons, as the courts have consistently upheld the fact that commercial speech does not share the same first-amendment protection as private speech. According to the U.S. Supreme Court, "Nothing in the Constitution compels us to listen to or view any unwanted communication, whatever its merit . . . . The asserted right of a mailer, we repeat, stops at the outer boundary of every person's domain." (See http://www.jmls.edu/cyber/cases/spam.html for further details about the court cases.)

Another spammer defense is, "Just hit Delete." But how many times a day are you willing to hit the delete key to keep your Inbox clean? Once? A dozen? One hundred?

Watch out for a common spammer scam: the infamous "Remove" list. Nearly every spam contains text to the effect that if you reply to the message with the word "Remove" in the subject, you will not be spammed again. Let me explain what really happens. Assuming that the reply address isn't forged and your "Remove" request can be received at all, your address is collected, along with all of the other suckers who have responded, and when enough arrive, they are all burned in to a CD-ROM and sold to other spammers as "guaranteed live and responsive ad dresses." Once your e-mail address has been harvested in this manner, you'll never be spam-free again.

Even if these "Remove" requests were honored, this opt-out model could never work. The Federal Trade Commission estimates that there are roughly 20 million small businesses in the United States. Let's assume that only 1 percent (200,000) of these businesses decides to use UBE as a marketing tool. Furthermore, let's assume that each spamming company decides to spam their advertisement only once per year. That means on any given day, approximately 550 companies are spamming. A conservative mailing list might contain one million addresses, although CD-ROMs with more than 30 million addresses are available. So we have 550 million e-mails divided among (approximately) 40 million Internet users worldwide. This means that you could conceivably end up sending "Remove" requests 13 times a day, every day for a year, in order to get off the spammers' lists. Remember, that's if just 1 percent of U.S. companies decides to spam once per year.

Advocates of spam argue that e-mail is cheaper than postal mail, good for the environment because it reduces paper consumption and deforestation, and doesn't contribute to landfill waste. The rebuttal is simple. First of all, unsolicited postal advertising is a self-limiting model. Companies want to reach people whom they are reasonably sure will be interested in their product, and do not have the budget to blindly shotgun their ad to every address they can find, as spammers do. Also, the typical spammer could never afford to send unsolicited postal mail on such a massive scale, so no trees are being saved by them sending spam. Second, bulk postal mail actually subsidizes first-class mail for the rest of us. Spam offers no such subsidy.

 

How are we fighting spam at CU?

Spammers use a variety of tricks and subterfuge to hide themselves, because they already know that the average netizen doesn't like spam, doesn't want spam, and given the opportunity, will complain about receiving it. ITS UnixOps receives complaints every week about the latest batch of spam to sneak past our filters. We have taken many steps to lock spam out of our domain, because contrary to popular (spammer) belief, the Internet is not a public playground without any rulesit is a collection of private networks owned by private entities who voluntarily peer with each other to exchange data. Any one of those entities has every right to dictate who may share their resources, and who may not. Here at CU, we try to reject all incoming spam e-mail, however, we tend to err on the side of caution. We do not wish to block even a single piece of legitimate incoming mail. So, the filters we have in place do three things:

 

  1. Reject any piece of e-mail that claims to originate from a nonexistent domain. This prevents spam with forged From: lines such as friend@public.com or 08790633@29769.com.

  2. Deny third-party relaying through our servers. This prevents spammers from hijacking our machines to deliver spam for them, and making it appear as if it originated from within the colorado.edu domain.

  3. Selectively blacklist known spammer addresses. There are a few domains that exist solely for the purpose of sending UBE. We know who they are and refuse to accept mail from them, period.

Even with these rules in place, spam still gets through. Many times spammers will forge their origin and masquerade as a real domain. This causes all e-mail bounces and complaints to be directed at the forged victim, rather than the spammer, essentially electronically mailbombing the victim. More and more frequently, the domains that are attacked in this manner are taking spammers to court. Both JUNO and UU.NET recently announced lawsuits against a particularly tenacious spammer who had forged their return address many times.

The answer to stopping spam entirely is not to suffer it silently. Learn to read e-mail headers and deter mine the path of a message. Go to this "Reading E-mail Headers" Web site at http://www.stopspam.org/email/headers/headers.html. Complain to the spammers' service providers. Visit http://www.cauce.org and join the effort to legislate against UBE. Above all, educate yourself and then do something about spam, or it'll be shoveled into your Inbox endlessly.