We've had a bellyful of spam

EVERY morning when you sit down to switch on your computer at work, are you faced with an e-mail inbox packed full of messages from people you’ve never heard of? Messages which can tell you how to purchase cheap Viagra, how to increase the size of your manhood or your breasts, or how to see pictures of naked celebrities?

Well you are not alone. In fact such unsolicited e-mails - or spam as they have been dubbed - now make up 60 per cent of all electronic mail sent in the world, and that figure is set to rise. In October alone, one in every four e-mails to financial services firms in Britain was spam. And it’s been claimed that this is costing businesses £20 billion worldwide in slowdowns, lost productivity and extra work by company computer helpdesks as workers hit away at the delete button every time another unwanted e-mail crashes their inbox.

On top of that, Brightmail, a company which specialises in filtering e-mails for fraud and spam, recently found that ten per cent of all e-mails were scams of one sort or another, including brand spoofs - e-mails that pretend to come from famous and trusted consumer companies - fake web pages, phoney press releases, and "phishing", which trick recipients into giving out sensitive information, such as credit card numbers.

It’s no wonder that it is fast becoming one of the most hated aspects of modern working life. Just this week MSPs complained that they’re being swamped with offensive e-mails and that it takes them hours to differentiate between genuine correspondence and the spam despite repeated attempts to filter it out. As Christine Grahame, SNP MSP says: "It’s intolerable. If it’s not foreign men looking for money it’s some firm advertising Viagra or extolling the benefits of extensions for parts of the body. Not only is filtering it out time-consuming and irritating it can also be offensive."

So offensive did one American computer programmer find it that he threatened to kill the employees of the company he blamed for bombarding his computer. Charles Booher, 44, was arrested for making repeated threats to staff of a Canadian company, but while he acknowledged that he behaved badly he said: "I go to their website and start complaining to them: ‘Would you please, please, please stop bothering me.’ It just sort of escalated ... and I sort of lost my cool at that point."

Thousands would sympathise. So what is being done to stop the torrent of unwanted e-mails which leave many receivers acutely embarrassed if not downright angry?

It seems current approaches aren’t working. Even though home users and many companies started filtering their e-mail years ago, the overall amount of junk mail has ballooned. Filtering and anti-virus companies always seem one step behind the rapidly evolving methods of clever spammers. And in America at least, any legal cases against spammers have been defeated, settled or concluded with the penalties levied against spammers unpaid, and their e-mailing operations still open for business.

And spam is big business. One American spammer, Scott Richter, says his company, OptInRealBig, clears 2 million (£1.15m) in sales each month thanks to the 80 million e-mail advertisements they send out a day. His company sells diet pills, porn sites, sexual aids and "miracle" products. Unsurprisingly he argues that there’s nothing wrong with unsolicited bulk commercial e-mail messages, or spam. He also says that bulk e-mailers are relatively immune from new laws and lawsuits. "We can set up in another country within an hour," he says.

However, new legislation will come into force in the UK on December 11 which will at least make it illegal in Britain for spammers to send unsolicited e-mail to personal e-mail addresses. But the Government has been accused of bungling the EU anti-spam directive as there’s no provision to stop business e-mail addresses being spammed.

Spamhaus, the anti-spam action group, says the law "lacks bite". A spokesman says: "What it means is that spammers found guilty by a court face a fine of just £5000 and they can also keep sending junk mails until issued a direct order to stop by the Information Commissioner. By contrast, Italian spammers can face up to three years in jail."

But Stephen Timms, the E-commerce Minister, and the man responsible for Britain’s implementation of the directive, says the opt-out for business e-mail addresses was what people wanted. "It was down to the consultation we had with businesses," he says. "I think on the whole what we’ve done has been pretty robust on spam. I think it’ll be pretty effective as far as intra-European spam is concerned, but of course the big difficulty is that most spam is coming from outside Europe."

Indeed it seems that whether or not the British Government extended the rules to businesses, volumes of spam would be little changed as most comes from the US. A recent study showed that America creates 58.4 per cent of spam; China 5.6 per cent; Britain 5.2 per cent; Brazil 4.9 per cent; Canada 4.1 per cent and all other countries 21.8 per cent.

Timms adds: "I think it’s very important that we are in discussions, specifically with the US. There are initiatives over there at state level which look like what we’ve done in Europe."

Next month, spam is on the agenda of the World Summit on the Information Society in Geneva and Timms says: "The key question is, is there some way we can reach agreement, either bilaterally or, preferably, multilaterally, that would allow us to apply some of these sanctions to spam from outside Europe?"

Eradicating spam is a top priority for the American government and global computer firms, however even there there’s debate about how far any legislation should go. Companies like Microsoft think honest firms should be able to openly advertise to anyone who has used their products in the past. "I don’t think you can put that in the same bucket with outright fraudulent, criminal behaviour perpetrated through spam," says Microsoft lawyer Tim Cranton. As a result Microsoft and other businesses have lobbied against more stringent measures that would allow individual PC owners to sue bulk e-mailers, and would limit spammers from sending messages to anyone who did not deliberately sign on to receive them.

The result of their efforts was the CAN-Spam Act, which recently passed through the Senate. It enforces a certain etiquette - e-mailers must be truthful in subject lines and honour remove requests - and lays the groundwork for the creation of a Do Not Spam list for businesses to join.

One of the most successful anti-spam firms is MessageLabs, which protects 7000 businesses worldwide, and whose service was rated by PC Magazine to be the most effective solution in the world, capturing 96.03 per cent of spam with only a 0.04 per cent false positive rate. The company’s technology, known as Skeptic, uses artificial intelligence to analyse e-mail DNA for the purposes of identifying and intercepting unsolicited or virus-bearing messages.

However the best way to solve the spam problem may be changing e-mail itself - by revising the code for delivering mail so computer systems can check whether incoming e-mail is faking its origin. But those changes would take years to trickle down into every network around the world.

In the shorter term so-called "challenge/response" systems could offer some relief; they let users send direct messages only to people who have the sender in their address books. When you e-mail a stranger, the system sends back a puzzle that only a human, not an automated spam program, can solve; give the correct response, and the e-mail goes through. Another system, dubbed "micropayments", charges a tiny amount for each e-mail sent and could add up to large sums only for bulk e-mailers.

And although both these solutions conflict with the original open and free-of-charge spirit of the internet, ultimately they’re among the few reliable ways to foil out-of-control spammers and fraudsters.

However, filtering is also getting better and a favoured option is to use a system which automatically accept mails containing passwords. Experts suggest something as simple as the user’s phone number would make a highly effective password. Others are now able to spot when a numeral has been used instead of a letter such as a "1" rather than an "i" in Viagra.

In the meantime it will be up to the new EU laws which come into force next week to tackle the problem head on. But as Martin Lenaghan, spokesman for the European Electronic Messaging Association (EEMA), says: "There are still few clear guidelines within Europe or the USA, to combat the expensive, disruptive and debilitating problem for businesses, 80 per cent of which is created by approximately 180 spammers worldwide.

"Waiting for the internet to fix itself is not the answer. If spamming is allowed to continue without both legislative and technological intervention, there is no doubt that it will lead to the death of e-mail."

Know your enemy

• What is spam? While most e-mail users think they know spam when they see it, it has proven surprisingly difficult to define. Some of the most common definitions are: unsolicited commercial e-mail which excludes unsolicited political messages and possibly outright fraudulent ones; unsolicited bulk e-mail; and unsolicited electronic mail solicitations, which would include even single unsolicited e-mails.

• Who sends it? The spammers who flood your inbox on a daily basis are most likely members of a relatively small, shadowy group of professionals capable of generating hundreds of millions of e-mails each day and using hi-tech evasive tactics to avoid detection. Together, these big operators send the vast majority of unwanted e-mail. But they don’t work for free, and a wide variety of small-time crooks, inventors and even major companies may ultimately be behind the campaigns.

• What does it cost? Each year spam costs each receiver between £20 and £30 and companies £450 in lost productivity for every employee with e-mail, according to the Anti-Spam Research Group.

• How can it be avoided? Most spammers build e-mail lists by harvesting addresses from web pages and postings. So avoid putting your e-mail address on a web page. Or use multiple e-mail addresses, and save one for filling out web forms and submitting to companies. Read online forms and software registrations carefully. Be sure to "opt-out" at every chance, letting companies know you don’t want them sharing your e-mail. And complain. Not enough individuals go to the trouble of figuring out who’s really behind spam.