February 4, 2001

In the war against spam, some real mail gets sidetracked

Associated Press

NEW YORK

Wars often have their casualties from friendly fire — allies accidentally killing or injuring their own. The war on spam is no different.

Aggressive tactics to block unwanted commercial e-mail sometimes weed out legitimate items as well. In the name of fighting spam, Hotmail and some other e-mail services also restrict addresses to which their subscribers can send messages.

It's a spiraling war of attrition: As spammers find new ways to circumvent spam controls, mail service providers develop more aggressive ways to fight them. And that increases the risk of inadvertently blocking the good mail with the bad.

Gilles Frydman, president of the Association of Cancer Online Resources, said spam filtering at Internet "post offices" sometimes keeps certain messages from reaching members of his online support groups — often without their knowledge.

Yet some network administrators consider e-mail loss a necessary evil to prevent spam from overwhelming mail servers and clogging the Internet.

A 1999 study by the Gartner Group found that 64 percent of Net newcomers are subjected to spam at least once a week. For veterans who've been with the same Internet service provider for at least three years, the figure rises to 91 percent.

"A single spammer can send out 5 to 10 million a day pretty easily," said Ken Schneider, chief technology officer for Brightmail Inc., which develops filters for Earthlink and other service providers.

Earthlink estimates that up to 15 percent of its weekday mail traffic is spam.

Until recently, Microsoft Corp. blocked users of its Hotmail service from sending e-mail to Peacefire.org, an organization critical of online censorship, because the group uses a mail service identified as spam-friendly.

Although Microsoft ultimately removed Peacefire as a target, many users complained that the company's zeal amounted to censorship.

The problem isn't limited to Peacefire or to Hotmail.

Topica Inc., which hosts more than 50,000 e-mail lists delivering some 300 million messages a month, gets inadvertently blocked by one or another service provider about once a month, chief executive Ariel Poler said.

Last summer, online research company Harris Interactive sued America Online and other Internet providers for classifying Harris survey requests as spam, even though recipients had agreed to participate in the surveys.

Harris ultimately got the companies to accept its mail again, and it dropped the lawsuits. Harris spokesman Dan Hucko estimates the company lost hundreds of thousands of dollars in the meantime.

David Cassel, who writes an "AOL Watch" newsletter critical of America Online, also had trouble at one point e-mailing newsletters to his subscribers.

"What's the point of a mail service if they only deliver some of your mail?" Cassel said. "You also have to worry once you hand over to a big corporation the power to pick and choose which e-mail you receive."

The fight against spam isn't easy.

From a technical standpoint, "there's very little difference between e-mail you want and spam," said John Levine of the Coalition Against Unsolicited Commercial Email. "You can't even get two people to agree exactly what spam is, so you can't produce a perfect spam filter."

Most people agree that unsolicited commercial e-mail sent in bulk qualifies as spam.

But what about unsolicited bulk mail that is noncommercial, such as those seeking charitable donations or delivering political messages?

Then there are bulk messages that users unknowingly solicited — for instance, by purchasing from an e-commerce site without explicitly saying "no" to promotional materials.

Mail service providers often have to make decisions on the fly about what is spam and what is not.

They've developed tools to detect mail sent in multiple quantities. They check for the fake e-mail headers that spammers use to hide their origins.

Some also use lists of spam-friendly addresses from a Redwood City, Calif., organization called the Mail Abuse Prevention System, or MAPS.

Mistakes happen.

"Certainly, to most users, if informed of the trade-offs," Levine said, "they hate spam so much and get so much of it, they find the risk of losing a tiny bit of mail perfectly acceptable."

Spam has crashed or slowed some mail servers, said Margie Arbon, a MAPS staff member. In other cases, companies have had to add capacity at significant cost to handle the spam traffic.

MAPS tracks Internet computers that have generated spam in the past, that relay bulk messages or that otherwise have not done enough to block spam.

Peacefire's Internet host, Media3 Technologies, got on one list because some of its customers sell software that could be used to send spam. Media3 says it doesn't support spam and complains that the MAPS criteria is too broad.

Peacefire says it was essentially caught in the crossfire.

Sarah Lefko, a Microsoft product manager who oversees Hotmail, said spam blocking provides Hotmail users with "a more enjoyable experience."

AOL and Hotmail, among others, automatically delete the mail deemed spam before it reaches the user. Other services, such as Earthlink and Yahoo!, send all suspected items to spam mailboxes.

Lisa Pollock, director of Yahoo's messaging group, fears that without effective spam controls, subscribers may find e-mail unmanageable.

"If people don't like our service," she said, "they won't use it."