SPAM IN IRELAND AND POSSIBLE REMEDIES 
Tue, 11 Mar 2003 

A Computers In Business/Small Firms Association survey indicates, over 80% of small companies in Ireland now regard spam - or unsolicited commercial e-mail - as either "somewhat of a problem" or "a big problem". What's more, the amount they're dealing with is staggering.  Three quarters of Irish businesses say that at least 10 per cent of their e-mail is spam. 

Worse, over a quarter of them complained that 40% or more of their incoming e-mail is spam.  And if that's not bad enough, a third of Irish companies said that the most common content material they get is sexual.  Todays published survey tallies with international experience.  BrightMail, probably the biggest company selling anti-spam services, said it has seen spam on its customers' networks increase from 8% of mail to 41% of mail in the last fourteen months.  One of the other behemoths, Internet filtering company Surfcontrol, arrived at the same figure.

Even conservative estimates suggest that in the next couple of years, internet users will be sending and receiving more than 10 billion spam messages each day.  But whether it's 10, 20 or 40%, all companies agree that spam has got much much worse in the last year, both in Ireland and around the world. 

This is because of two main reasons.  First, as a marketing ploy, it's very cheap.   Recently a spammer was paid $1,500 [€1,400] to send one million spam items.  Even with a response rate of just one tenth of one per cent, that's 1,000 likely customers reached for $1.50 [€1.40] a head.  For the spammer, the cost was negligible.  Add to this the fact that growing companies can't afford massive advertising drives any more, and you've got a clutch of hungry young entrepreneurs who are willing to do some grey marketing.  Growing numbers of e-businesses can't afford to blow $50 million (€45 million) of IPO money on TV and direct mail campaigns any more. 

All the people being laid off into a depressed job market are looking for new sources of income.  Aside from any considerable annoyance factor, though, there is growing evidence that this plague is beginning to cost Irish companies serious money.  This is accounted for in the time factor spent each day deleting spam.  It is hard to know what it costs but it is time that could be better-spent making money.  The European Commission has estimated a figure - it claims spam costs €10 billion in lost productivity every year.  If true, this would mean an annual loss of about €100 million in Ireland. 

While that may seem hard to believe, some other tallies back these figures up. Gartner, an IT specialist research firm, said that a company with 10,000 employees loses €14 million a year because of spam.  In Dublin, the Irish Interactive Advertising Bureau is so concerned about the issue that it is setting up a special task force to find out how much spam costs Irish business.  The bureau has more incentive than most to stem the growing anger in corporate Ireland about junk e-mail.  According to chairperson, Mary Mangan (also the chief executive of Ireland.com), the "vast majority" of its 33 members engage in "legitimate" e-mail marketing - commercial e-mail which is genuinely permission-based and from which you can easily unsubscribe.  Mangan feels that the rubbish circulating around Irish e-mail boxes is dragging a legitimate and potentially valuable marketing tool into complete, perhaps irreparable, disrepute. 

There's now a fear among companies about using e-mail marketing, about how to do it legally and not be classified as part of the spam problem.  This fear of being lumped with "scumbag" spammers is so deep within the industry that the Interactive Advertising Bureau now recommends that its members use a 'double opt-in' guarantee for some e-mail marketing activities.  That means that the receiver - you - would need to consciously tick a box (which said "E-mail Me Some Offers" or such) twice before getting any marketing e-mail. 

This seems laudatory compared with the `opt-out' method of permission-based marketing, which requires you to tick a box if you don't want to be e-mailed.  (This format is usually printed in small writing and hidden down the end of the website.)  But it's something that seasoned spam warriors have been calling for some time.  The bad stuff is now at such a high volume that it's definitely bringing down tolerance for other commercial e-mail, according to Deersoft, Inc., the makers of the excellent Spam Assassin software that works with Outlook. 

The direct marketing companies really need to come up with something to distance themselves.  Ireland.com is an interesting case in point.  It has 24,000 subscribers, 80 per cent of whom are in Ireland.  It leverages its subscriber base as best it can commercially, but sets itself some strict rules.  Rule number one - no subscriber gets more than two marketing e-mails a month.  Even if he ticks all of the `product interest' boxes (at least one of which must be ticked to receive any marketing e-mail from Ireland.com), he won't get more than two a month.  Rule number two - no-one outside Ireland.com gets to see the Ireland.com list of subscribers. 

If a company wants to pitch something to its subscriber base, they can - but Ireland.com will control the delivery of the e-mail.  Other Irish companies, which appear to be flourishing along these careful lines of permission-based e-mail marketing, include Salesonline.ie and three-year-old Pigsback.com.  But apart from the responsible e-mail marketing - the one per cent of commercial e-mail we receive - what about the annoying stuff? 

The most obvious option is put in a spam filter.  There are plenty of free resources and basic packages, but be warned, not everyone is happy with them.  The problem with anti-spam software is that a lot of it ends up blocking relevant content.  There are situations where legitimate companies end up on blacklists.  So the users end up turning it off.  So-called `blacklists' - which work by identifying known spammers and suspicious e-mails - are becoming less popular with Irish companies.  (Only one in four small Irish companies use an anti-spam remedy, according to the survey.) 

Big companies will stick with it in the long term, but smaller companies feel they may be missing real e-mails.  Fighting spam is more to do with "a process of education" within the company than with any one tool.  The worst thing you can do is click the `unsubscribe' button because, basically, you're going back to them and saying `I do exist, subscribe me to a few more spam mails'. 

As soon as you appear on a few spam lists, it just snowballs.  This is confirmed by a study carried out last month by network security firm Iomart for Dublin law firm Masons.  Iomart set up 5,000 test e-mail accounts.  It found that eight out of ten spam e-mails have hidden `tracking codes' that alert spammers as soon as the messages are opened. 

These tracking codes allow the spammers to record the e-mail address and tick it off as `active'.  To trigger the tracking code, all you have to do is open the spam e-mail.  Which is exactly what Iomart did.  After a two-week period, the volume of spam received on these accounts doubled.  Hundreds of worthless e-mails became thousands.  The rule is simple.  Do not open spam if you want to minimise it. 

A lot of spam is evident from the subject header and sender's name.  If you suspect its spam, the easiest thing to do is to delete it.  Otherwise you're letting the senders know that you exist and you will receive more.  Think you can avoid this by sneaking a peak in your e-mail 'preview panel'?  Think again.   Popular software, such as Microsoft Outlook or Outlook Express, lets the user read a section of the e-mail in the preview window before opening the full e-mail. 

Be warned that viewing a preview panel will activate the hidden tracker code - so don't use it if you want to minimise spam.  

Is there any hope? Not in the short term, say industry experts and legislators.  I think we're almost at a point where people have more spam in their inboxes than e-mail, what a mess.  

Technology being what it is can deal with spam.  It is for the main computer software manufacturers to do it and they should be forced.  It is time that the software vendors, who have made billions down the years, decided once and for all to fight spam in a proper and meaningful way in order to eliminate it completely. 

Internet Service Providers and e-mail services providers should be forced to make it impossible for people to register and use fake e-mail accounts and addresses.  Spammers should be named and identified to the public.

Art O'Hara

Stop SPAM in Ireland with MailWasher Pro

A few weeks ago, I noticed an interesting trend in spam.  Amid the promises of hot teenage cuties and the missives from Africa offering riches in return for a small good-faith investment was a stream of superficially legitimate-looking ads for Norton SystemWorks 2002 and other software from Symantec.

A quick investigation of these messages and of the Web sites they linked to established that they had no direct connection to Symantec, even when the sender's address on the mail indicated otherwise.  Probing deeper, I gained a new perspective on the strange, dark side of e-commerce and uncovered some online traps awaiting the unwary.

There were a lot of similarities among the messages I received. Each one carried a forged sender's address.  But a perusal of address information normally hidden by mail programs showed that the advertisements came from a variety of accounts, mostly outside the U.S.  Each message offered a software package at a deep discount.  A favorite was Norton SystemWorks 2002, a collection of utilities including antivirus and firewall software.  At the time, it sold for about $100 but was priced at $29.95.

Each message was linked to a Web site where an assortment of Symantec software was selling at similarly low prices.  The sites themselves fell into two general groups: ones such as www.deal2002.com and www.supersave.biz, registered in the U.S. and with registration information giving the names of actual, locatable administrative contacts; and ones that identified themselves only by a numerical address, such as 202.108.221.18.  To the limited extent that these sites can be traced, they seem to be mostly in China.

Almost all of the Web sites claim to use secure technology for taking orders.  But many, including all the numbers-only Web addresses that I checked, do not use secure protocols to transfer credit-card information.  At best, you risk exposing your card number and personal data; at worst, you may be caught in an outright credit-card scam.

How do legitimate products end up getting sold in such dubious ways?  "It's not coming from Symantec," says Joy Cartun, the company's director of legal affairs.  "We don't have those sorts of campaigns.  " William Plante, Symantec's director of worldwide security, puts it even more bluntly:  "Ninety-nine percent of the time, this stuff is counterfeit."  Symantec regularly checks out the product being sold on the Web, and Plante says he knows of only one case where deeply discounted software was not counterfeit.

Alan Moore, who operated deal2002.com (he has since shut down that site), takes strong issue with the claim, saying he is buying software that Symantec originally sold to computer manufacturers for installation on new machines.  "Nothing we sell has ever been pirated, bogus, or advertised as anything but what the customer ordered," he says.  "All we offered is software that is bought at wholesale prices and retailed.  " Plante declined to comment specifically on the products sold by deal2002.com, saying only that Symantec was investigating the case.

Given such uncertainties, what is a consumer to do?  In general, I would avoid buying from Web sites that market using spam.  The small amount of money  you are going to save are not worth the risk.  Although the software you get, assuming you get any, will probably work all right, the chance of credit-card fraud or identity theft is serious.  To be safe, don't deal with a Web site whose only address is a number.  And don't enter credit-card or other personal information unless your browser shows a locked-padlock icon at the bottom, indicating a secure site.

In the future, we will probably see fewer solicitations of this sort.  Microsoft has largely eliminated such sales through its annoying-but effective-policy of requiring each copy of Windows or Office to be activated using a valid serial number.  As Symantec and other publishers wage war on piracy, approaches like Microsoft's will likely become the rule.

END

Stop SPAM in Ireland with MailWasher Pro