Spam is flooding e-mail inboxes faster than ever before, causing ISPs
and cable operators to do whatever they can to stanch the
flow well before it delivers a crippling blow

Spam, to borrow a sports cliché, is a lot like Emmitt Smith in his prime. You can't stop it; you can only hope to contain it.

Or at least that's how it seems lately, as we start each day plodding through inboxes full of unsolicited messages peddling everything from cheap Viagra, free digital cable and enough pornography to fill servers by the Gigabyte.

Spam, once just a nuisance, is now spinning out of control for service providers and consumers alike.

"It's a 21st century version of a plague of locusts," describes Laura DiDio, senior analyst with the Yankee Group.

But it's a phenomenon that has reached prodigious proportions only recently. "Spam, at this time last year, was an occasional annoyance," she says. "Now we're even getting spammed by the anti-spam people."

The amount of spam traversing the Internet and e-mail boxes has been on a tremendous growth path over the last eight months or so. Prior to the terrorist attacks on Sept. 11, 2001, only eight percent of messages were spam, says Ken Schneider, chief technology officer with Brightmail Inc., an anti-spam specialist whose broadband clients include Adelphia Communications, Cablevision Systems Corp. and Comcast Corp.

That figure rose steadily to 30 percent and 40 percent through 2002. According to Brightmail figures, spammers launched more than 7 million unique attacks in April.

"Now [spam represents] about 50 percent when we look across our customer base," Schneider says.

If receiving a higher number of customer complaints about spam isn't enough, controlling it can cost real time and money.

Cox Communications, for example, employs an in-house team dedicated to handling service abuse.

"Spam has been a big focus for them lately," says Jim Reed, Cox's product manager for residential high-speed Internet. Money, he adds, is also tied up in storage systems that grow larger and larger as more and more spam courses the Internet and makes its way to Cox's e-mail servers.

But Cox is far from alone in its plight. Time Warner Cable also shells out greenbacks to maintain a technical staff that snuffs out spam attacks when they're about to overwhelm an in-bound mail server.

"Spam is costing us real dollars and real resources to combat," says Mark Herrick, director, operations security for Road Runner. "It's quickly becoming a customer issue that's bubbled up to become our issue. Over the past 18 months, I have brought on a dedicated engineer to handle policy issues related to the amount of spam that comes into our subscriber accounts." Herrick has also hired a staffer dedicated to handling customer spam complaints.

The spam epidemic has also put a serious hit on employee productivity across the country. The Yankee Group estimates that junk e-mail translated into about $8 billion in corporate losses last year, a number that could easily grow to $12 billion by 2004.

"Even though we're [controlling spam] 10 to 30 seconds at a time, at the end of the day, we probably spend 30 minutes getting rid of it," DiDio estimates. For an employee making $40 per hour, that adds up to $20 per day, or $4,800 per year per employee.

Spam divided by category


Spam, for all the bad it does, has inadvertently spawned a vibrant market of companies that build a variety of spam-killing tools. In addition to Brightmail, the sector teems with others such as Trend Micro, Sunbelt Software and Postini.

Spam has also given rise to a raft of client-side junk e-mail filtering applications. A search for "spam block" on turned up programs with titles such as "AllSpamGone," "Spam Inspector," "Spam Bully" and "Spam-Gunner."

A company such as Brightmail, though, uses network, server-side systems that detect and destroy spam at the perimeter.

"We take a real-time system with millions of addresses and messages that come into us from our decoys to our network center," Schneider explains.

From there, the system looks for spam "attacks," or logical groupings of messages based on their content, that might be launched from single or multiple PCs.

Among other tools, e-mail and broadband messaging specialist Openwave Systems Inc. recently issued a new version of a platform (Mx Version 6.0) that comes equipped with on-board spam protection measures. Openwave, citing results of an Asia-based operator, said the platform blocked 56 million unwanted messages per day (97 percent) during a two-week period.

Spam-blockers will aid MSOs, Reed notes, because consumers are increasingly demanding that their ISPs take on the burden. But there's a fine line, because some consumers would rather hit the delete key and take care of spam on their own.

"There's a real balance there to make sure legitimate e-mail gets through, while also trying to serve the needs of the customer," Reed says. "But the number of complaints from our customers about receiving spam is seven times higher than it was six months ago."

And that's just from customers who don't want spam. Other complaints come from those who have unwittingly become spam nodes via an open relay or because their PCs have been infected by spam-propagating viruses.

Cox is trying to head off spam in three areas: education, engineering and software.

On the education front, Cox is creating a customer portal that highlights Internet safety features, including how they can combat spam and prevent their PCs from becoming open proxies.

Cox is also taking an engineering approach to the problem and is looking at a number of network-side spam-blocking systems. Cox has tested such a system in one market and is thinking about further rollouts. On the client-side, Cox has started to offer McAfee Security's "SpamKiller" program to its cable subs.

Road Runner has also implemented its own set of spam filters, including a top layer of mail gateways whose primary function is to identify unsolicited messages coursing onto the network. Lately, they've been blocking about 40 percent of the messages coming in, most of them related to proxy servers, open hijackings or other known spam source networks.

But filtering e-mail remains an inexact science. "The unknown part of that is how much of the 60 percent that got through is mail that a subscriber receives and hits the delete button," Herrick says.

EarthLink Inc. is also throwing everything it can at the spam problem. In an effort to give customers full control of their inboxes, EarthLink recently introduced "spamBlocker," a home-grown platform that invokes a "permission-based" auto-response to spam sources and unrecognized e-mail addresses. The sender, if not recognized, must fill out a short form before gaining access to the inbox, but the subscriber can accept or reject the request.

EarthLink also offers a "spaminator" tool from Brightmail that intercepts suspected spam and provides an optional feature that blocks pop-up Web windows.

But not all anti-spam efforts are technical in nature. Several large ISPs and government interests have put spammers on notice through the legal system.

EarthLink has swung the sword of litigation liberally. In May, it won a $16.4 million judgment against Howard "The Buffalo Spammer" Carmack, who allegedly distributed more than 825 million spam messages since March 2002. EarthLink has also won $2 million and $25 million judgments against alleged spammers in recent years.

Microsoft also took off the gloves in mid-June, filing 15 lawsuits in the U.K. and the U.S. against alleged spammers. Microsoft claimed those named in the suits have flooded MSN electronic inboxes and the company's systems with more than 2 billion spam messages.

So troublesome is the spam epidemic that several major ISPs, including Microsoft's MSN and EarthLink, banded together this year to form a coalition that will create anti-spam standards and establish best practices. America Online Inc. and Yahoo! Inc. are also part of the alliance.

The government is also playing a big role. In May, the California State Senate approved a bill that would make spamming a crime and empower consumers to sue spammers for about $500 per message. The bill, now in front of the California Assembly, would require e-marketers to obtain approval from their targets to receive the messages. Delaware already supports an "opt-in" anti-spam law.

Despite the technical and legal actions against them, spammers remain a smart lot, always dreaming up new schemes to elude the nets.

So ISPs and spam-killers must stay a step ahead, or at least in lock-step, as new techniques emerge.

Brightmail, for example, stays on the case day and night. "We create new rules based on those attacks, and push new rules out the door every 10 minutes, 24 hours a day," Schneider says.

But rules are made to be broken. "There is a bit of an arm's race," admits Dave Baker, vice president of law and public policy for EarthLink.