Tangled Up in Spam

February 9, 2003
Tangled Up in Spam
[www.nytimes.com]

By JAMES GLEICK

I know what your in-box looks like, and it isn't pretty. It looks like mine: a babble of come-ons and lies from hucksters and con artists. To find your real e-mail, you must wade through the torrent of fraud and obscenity known politely as ''unsolicited bulk e-mail'' and colloquially as spam. In a perverse tribute to the power of the online revolution, we are all suddenly getting the same mail.

The spam epidemic has just a few themes and variations: phone cards, cable descramblers, vacation prizes. Easy credit, easy weight loss, free vacations, free Girlz. Inkjet cartridges and black-market Viagra, get-rich-quick schemes and every possible form of pornography. The crush of these messages on the world's networks is now numbered in billions per day. One anti-spam service measured more than five million unique spam attacks in December, almost three times as many as a year earlier. The well is poisoned.

Spam is not just a nuisance. It absorbs bandwidth and overwhelms Internet service providers. Corporate tech staffs labor to deploy filtering technology to protect their networks. The cost is now widely estimated (though all such estimates are largely guesswork) at billions of dollars a year. The social costs are immeasurable: people fear participating in the collective life of the Internet, they withdraw or they learn to conceal their e-mail addresses, identifying themselves as user@domain.invalid or someone@nospam.com. The signal-to-noise ratio nears zero, and trust is destroyed.

''Spam has become the organized crime of the Internet,'' said Barry Shein, president of the World, one of the original Internet service providers. ''Most people see it as a private mailbox problem. But more and more it's becoming a systems and engineering and networking problem.'' He told the 2003 Spam Conference in Cambridge, Mass., last month that his service is sometimes pounded by the same spam from 200 computer systems simultaneously. ''It's depressing. It's more depressing than you think. Spammers are gaining control of the Internet.''

If your own experience doesn't seem this bad, just wait. You may be a recent convert to e-mail; your address may not yet have percolated through the deep swamp of spammer databases (truly a land of no return). Quantity matters, psychologically. If five daily spams seem merely annoying, 20 or 30 will be maddening, creepy -- and chilling. Some avid Internet users report a hundred or more a day.

The harvesting of e-mail addresses by spammers is relentless and swift. Investigators for the Federal Trade Commission recently posted some freshly minted e-mail addresses in chat rooms and news groups to see what would happen; in one case, the first spam came in nine minutes. Addresses are sold and resold on CD-ROM's in batches of millions. If you have ever revealed your e-mail address in a public forum, or allowed it to appear on a Web page, or used it in buying merchandise online, your experience of the online world is sure to sound like this: ''Looking for love?'' ''$900 weekly at home.'' ''Fwd: Your winning lottery ticket.'' ''Biggee your penis 3 inches in 22 days.'' ''Have you received your cash?'' ''Hard core so intense it's sinful.'' ''Advanced degree = advanced career.'' ''Natural enlargement where you need it.'' ''Live chat room with real women!!''

Your correspondents claim to care about your health. Unfortunately, they care mainly about the length of your penis and the size of your breasts. They do not discriminate by sex; either way, you are assumed to feel inadequate. They offer implants and human growth hormone therapy. They are pharmaceutical enthusiasts, but we're not talking about penicillin; it's ''Viagra-Phentermine-Xenical-Propecia and MORE!'' They care about your finances. Here come the guaranteed paths to mortgage deals of a lifetime, cheap insurance, million-dollar prizes, hot stock tips and secrets of commodities trading.

Parents panic when they discover that their teenagers have mail from ''Mellisa'' at SexAffair.org: ''Hi there! I got your e-mail from Jennifer and I just wanted to tell you strait up, I really like -! She told me u're into -- too. Lets hookup for a juicy weekend.'' Does this mean the kids are checking out porn sites? (No, it does not.)

Another major spam category is ''fast cash -- work at home.'' More often than not this is a do-it-yourself kit -- you pay up front, and they send you everything you need to be a spammer from your own PC.

How this bane came to sully the greatest revolution in personal communication since the telephone makes for a complex and troubling story, with no promise of a happy ending. From the beginning, the Internet has tried to fight spam with grass-roots vigilantism. Software companies now routinely build spam-filtering technology into their e-mail programs, and independent programmers are struggling to devise more creative methods for separating wheat from chaff. Millions of individual e-mail users are trying to devise coping strategies of their own. Consumer advocates are working mostly in vain to persuade lawmakers to take action in what should, after all, be a popular cause.

Each in its own way, for different reasons, these efforts are failing.


Long, long ago, in a previous century, when the Internet was young, people discovered both the power and danger of mass e-mail. One online pioneer, Brad Templeton, says he believes he has pinpointed the first e-mail spam: in 1978, a Digital Equipment Corporation salesperson typed several hundred addresses by hand -- those of scientists and researchers on the Arpanet, the predecessor of the Internet -- and sent them an announcement of a product presentation. A small furor erupted. ''Where is the line to be drawn between this sort of thing (if it is to be allowed at all) and advertising?'' a recipient at Stanford University asked plaintively. The Net was a scientific and military enterprise -- most emphatically noncommercial.

The modern epidemic began 15 years later, coinciding with the explosive popularization of e-mail in 1993 and 1994. A chain letter began to spread, titled ''MAKE MONEY FAST.'' And a pair of Arizona immigration lawyers, Laurence Canter and Martha Siegel, bombarded the Internet with a notorious advertisement about the ''Green Card Lottery.'' Angry recipients counterattacked, overwhelming the lawyers' service provider with complaints. But these proto-spammers were unrepentant. Eventually they tried marketing a book, ''How to Make a Fortune on the Information Superhighway: Everyone's Guerrilla Guide to Marketing on the Internet and Other On-Line Services.''

Frauds and cons from the horse-and-buggy world quickly adapted to the new technologies. One of the most shameless is the so-called Nigerian spam. The subject is ''Urgent/Confidential'' or ''Assistance Required.'' The sender confides that he is a bank manager or political exile or son of the late commander in chief of the armed forces in Lagos. He explains that he needs your help in transferring $21.5 million in cash out of the country. ''I will like you as an foreigner to stand in as the next of kin. If only you will send your bank-account information, you can have a 40 percent cut.'' It's always the same letter, more or less. ''Should you not be in a position to assist, this deal has to remain a secret till the end of time.'' Sure. Some secret.

Few Internet users realize that this particular con began with handwritten letters and only recently grew into a mass-market business, in the category of World Gone Mad. Perhaps there's a reason for one con artist to ''solicit for your assistance in this mutually benefiting business transaction''; surely it defeats the purpose when they all send this same e-mail several times a day, week in and week out. Today it's from Dominic Tutu and Dominic Egbu, separately. Before that it was Dr. Lawrence Adu and Dr. Francis Oputa and Dr. Williams Ossai and Dr. Shuaibu Hamza. There can hardly be any unsuspecting victims left, so you have to wonder -- what's the point?

Early Internet users reacted so angrily to commercial mass mailings that fake return addresses became a necessity. America Online and other large service providers began closing accounts used for spam. The next big step -- indispensable to the spam epidemic -- was the rise of free mail services: Hotmail, now owned by Microsoft, and Yahoo. Two features of the modern Internet (both more or less accidental) make spamming easy: service providers desperate for market share at all costs; and an architecture of relatively open and insecure mail gateways. Together these enable hit-and-run e-mailers to create quick, disposable, false identities. It's why so many of your correspondents have addresses like ''buffy0412xxxmeb13mxy@hotmail.com'' -- though that one, offering me ''eBay insider secrets,'' day after day, turns out to be not just a pseudonym but also a forgery, not a real Hotmail account at all.

For that matter, anyone named Buffy who sends me e-mail is a spammer, judging from my experience. A suspicious number of my correspondents now seem to be called James. It seems safe to assume that a sender named NoMoreConstipation68487 is a spammer. Likewise for Persondude1 -- but no, that turns out to be my 11-year-old nephew. Sorting the good from the bad looks easy, but it's a real problem, both for humans trying to manage their in-boxes and for artificial intelligence.

A human being, looking at a sender called ''Ug56miZ5w@msn.com,'' can guess it's not a real person. Looking at subjects like ''Do your butt, hips and thighs embarrass you'' and ''My husband's not home, come and have me!'' and ''Make money fast'' (yes, this ancient artifact still makes the rounds), a human being knows enough to press the delete key. Why can't a computer be that smart?


Many programmers are working to automate the filtering of spam. The spammers, of course, are working to stay ahead. They forge identifying headers; some of your spam now appears to have been sent to you by you. They continually change the content, even adding random text. They make their subject lines sound real, or at least plausible:

• How are you?
• Thanks for requesting more information.
• Error in your favor.
• It is critical that your Internet connection is fixed.
• Someone is waiting for you.
• Listen to what people are saying about you.
• Pentagon readies war plans. (This one was an attempt to sell heating-oil options: ''$5,000.00 minimum investment.'')

Another gambit is to have their computers insert your name:

• James, is this still your e-mail?
• James, your paycheck has just increased!
• Hello, Gleick, darling.

All this in the name of tricking you into opening the message. ''Baby you're so strange'' -- can you resist? ''Do you remember me?''

Every major e-mail program now comes with filters meant to spare you the trouble. The idea is for the computer to detect spam and delete it, or at least move it into a separate folder where you can while away your time examining it later. Microsoft's e-mail clients use simple rules. If the first eight characters of the sender's name are digits, they guess the mail is spam. Likewise if the subject contains dollar signs and exclamation points, or if the message contains ''money back'' or ''check or money order'' or ''over 21'' or ''Dear friend.''

This approach catches less and less spam as time goes on, because the spammers buy the same software and test their mail in advance. If you're an enthusiastic computer user, you can add filters of your own. You can even download interesting filters from sites organized by other spam victims. You can't expect perfection. There will always be false negatives -- junk mail that manages to sneak through.

More troublesome, however, is the problem of false positives -- legitimate mail that is blocked. If your filter deletes what it thinks is spam, you may never see the message from your long-lost high-school sweetheart, who finally wants to make contact but uses too many exclamation points, or calls you a dear friend, or mentions sex.

Most corporate networks use spam filters, and many Internet service providers are also installing them, in response to pressure from their customers. The effectiveness varies widely. People use whitelists (friends) and blacklists (known spammers). People get frustrated and overcompensate, putting all of hotmail.com and yahoo.com and aol.com on their blacklists. ''Am I likely to miss important e-mail?'' writes Michael Fraase, a Minnesota Web consultant who goes to these extremes. ''Probably, but I have no way of knowing. Unfortunately the spam problem has become so bad that it's on the verge of rendering e-mail useless.''

One of the best tools for network administrators is an ever-evolving program called SpamAssassin, which uses a range of tests and a point system to identify spam. This is subtler than simple yes-no filtering. Messages get points for capitalized words like AMAZING and GUARANTEE and PROFITS. They get points for mentioning Viagra -- especially ''natural'' or ''herbal'' -- or penises or breasts. They get points for requesting a credit-card number, for including a toll-free number and for offering a full refund. They get points for odd-looking dates: much spam appears to have been sent in 1941; much appears to have been sent from the future. They get points for lively font colors and embedded scripts or links.

In a delightful SpamAssassin irony, a message gets extra points for declaring that it is not spam. After all, such statements are invariably lies. So are the following:

• This is a one-time mailing.
• There is no catch.
• This message is sent in compliance with spam regulations.
• You're getting this message because you registered with one of our marketing partners.

Like so much of the online world, spam becomes circular and self-referential and tail-chasing. Mail titled ''Clear your in-box of spam'' and ''Say goodbye to junk e-mail'' has to be spam.

SpamAssassin deploys hundreds of rules, adding more all the time and readjusting the weighting scheme. If a message has enough points, it's probably spam. But false negatives and false positives cannot be ruled out.

The newest approach to a technological solution is a different kind of filtering, based on statistics. A computer scientist, Paul Graham, caused a stir in the online world last summer with a proposal for adaptive, probabilistic filtering. The idea is to give up trying to list specific features of spam, to quit trying to get inside the mind of the spammers. ''Over the past six months, I've read literally thousands of spams, and it is really kind of demoralizing,'' Graham declared. ''Norbert Wiener said if you compete with slaves you become a slave, and there is something similarly degrading about competing with spammers.''

Instead, the new software keeps track of all the words in every e-mail, calculates their statistical probabilities as spam-indicators and adjusts these with experience. With his new method, he claims to be catching more than 99 percent of spams, with no false positives.

Graham's screed inspired many independent programmers to work on statistical filters. You train the software with a few hundred examples of good and bad mail, and the software starts to get smart. If you're curious, you can study the details. In my case, for example, the word ''Viagra'' appears almost exclusively in spam. The word ''vanilla'' appears almost exclusively in real mail. ''Awesome'' is bad; ''awful'' is good. ''Fraction'' is bad; ''fragment'' is good. I don't know why, and it doesn't matter.

''I was skeptical of filters, too, but in my case there wasn't much of a choice,'' says Michael Tsai, the author of SpamSieve, one of the more effective statistical filters. ''I don't have time to categorize my mail by hand, and if I did I'd probably get trigger-happy with the delete key.''

If you wonder why words like ''Viag.a'' and ''pen-s'' have started appearing in your spam, this is why. It's the spammers trying to outwit the filters. They have also begun appending random chunks of innocent text.

After weeks of training, my spam filter didn't see a problem with a letter titled ''See what hot girlz do behind closed doors!'' To a wary human, just the word ''girlz'' would be a giveaway. The filter didn't suspect anything unwelcome about a letter from Ivanna Come titled Obscene Facial Pictures. You can't say these spammers are brilliantly concealing their intentions. A human being gets the point. Yet none of these words, singly or in combination, triggered the alarm in my filtering software. The filter still thought this might be legitimate e-mail:

Looking for a good time?

Want some FREE ladies?

Then click here!


Deep inside the majestic Pennsylvania Avenue headquarters of the Federal Trade Commission lies the control center for the government's battle against spam, such as it is. This is the grandly named Internet Lab. It turns out to be eight PC's on desks.

''It's a great resource,'' says Brian Huseman, the F.T.C. lawyer assigned to tell me about the commission's spam-fighting. ''I don't know how we would do our spam investigations without it.'' While I watch, three young staff members surf the Web.

During the Clinton administration, the commission set up an e-mail address, uce@ftc.gov, for consumers to forward samples of their spam. The database now contains 27.5 million of these, and 85,000 more arrive daily. Every month or so, the commission files an enforcement action against someone, leading to a warning letter, or a promise by the spammer to cease and desist, or even, occasionally, a ''disgorgement of ill-gotten gains.'' No one really imagines any of this makes a dent.

The agency can't help noticing that, by and large, spam is not illegal. Its enforcers can go after only the most obvious forms of fraud, of which there is, after all, no shortage. The fact that you may not want to get this stuff is not their problem. ''From the F.T.C.'s point of view, whether it's wanted or unwanted, what we're concerned about is whether it's deceptive,'' Huseman says.

In reality almost all spam qualifies as deceptive. Junk messages typically come with false return addresses. The Internet headers are typically forged to falsify the mail servers, relays and other data that could help trace the source. Instructions for removing your name from their lists are typically false; your name won't be removed, and the spammer will know you're alive and reading the mail. In theory, any of these lies could justify action by the commission. ''Maybe there's a deceptive statement about how your name was acquired,'' Huseman says. Why, yes!

Here's a typical disclaimer: ''Best Net Offers never sends unsolicited e-mail. Best Net Offers has been given the right to market to you through our Web site partners and their privacy policies.'' That's a lie. Here's another: ''P.S. We never ever send spam we only send to people we think would enjoy this invitation! Psychic powers don't fail us now!''

In practice, it's hopeless. You can't prove that you never clicked a button marked ''O.K.'' after failing to read the fine print of a privacy agreement, thus unwittingly giving someone a sort of authorization to sell your e-mail address. The F.T.C. is a strong believer in these lawyerly privacy statements, but how many people read them?

You don't want to test the Click Here to Be Removed link, because you suspect it will just lead to more spam. This is just another in the series of spam Catch-22's.

The spammers are elusive and hidden -- one reason Barry Shein compares their operations to organized crime. ''These are not legitimate businesspeople,'' he said. ''These are people who are acting in a way that society does not accept.'' Yet it is often possible for a determined victim to track them down. Although headers will be forged, inspecting the HTML source of junk mail usually reveals a genuine domain name, because, after all, you are meant to visit some Web site. Domain names are required to list publicly a technical contact and an administrative contact. For example, SexAffair.org, which sends a torrent of spam from supposedly willing maidens called ''Erica'' and ''Jen'' and ''Katie,'' turns out to be Sobonito Investments Ltd., at 10800 Biscayne Boulevard in Miami. They handle Sex2go.com, too. I'd like to talk to them about this, but they don't return my calls. Anyway, until Congress sees fit to make their activities illegal, tracking down spammers provides little satisfaction.

Yet the perpetrators are not just misfits and pornographers. Real companies send spam, too -- because they don't know any better, or because they don't care, or just in rote obeisance to the gods of marketing.

E-mail marketers, from the sleazy to the near-legitimate, defend their behavior by citing postal junk mail and unsolicited telemarketing. These irritate consumers but are tolerated, up to a point. Spam is different. It is intrusive because, in the nature of e-mail, it arrives round the clock, demanding attention. It lacks even the modest checks and balances of traditional marketing: to print letters and send them through the post costs money; likewise to make telephone calls. A direct mailer can't afford a pitch so shabby and fruitless that it will produce a one-in-a-thousand rate of return. A spammer can, because sending a million more copies is practically free.


We citizens and consumers have more points of contact with the world than ever before; more points of exposure. Our front doors and mailboxes are one kind of interface; our telephones and fax machines another; our televisions and radios still another. Because networked computers open a pathway wider and faster and more fluid than all these combined, the spam epidemic will prove a need for new kinds of locks and new kinds of rules.

From an economic perspective, if the purpose of advertising is to get directly in my face, for the least cost, then spam is almost perfectly effective. It's in my face, all right. As a magazine reader, you might feel that advertisements are an intrusion, but you also know that the advertisers had to pay thousands of dollars and that this money supports whatever it is you like about the magazine. You've made a voluntary economic bargain -- as you do when you watch free broadcast television.

By contrast, advertising by e-mail is the ultimate free ride. The cost is borne by the recipients. This is a historical accident; no planners designed the economics of cyberspace to work this way. But the capitalists who laid the world's fiber-optic cable across continents and oceans get no return on their investment from the spammers; the Internet service providers whose computers send and receive these billions of messages get no compensation. Nor, of course, do we, the targets of spam -- we don't get the television program or magazine article or football game or service that other advertising dollars support.

Of course, if the purpose of advertising is to get me to buy the product, as opposed to turning me into a livid bundle of hatred and resentment, then spam is not perfectly effective. Yet the tide keeps rising.

Many people who hate spam believe, honorably enough, that it's protected as free speech. It is not. The Supreme Court has made clear that individuals may preserve a threshold of privacy. ''Nothing in the Constitution compels us to listen to or view any unwanted communication, whatever its merit,'' wrote Chief Justice Warren Burger in a 1970 decision. ''We therefore categorically reject the argument that a vendor has a right under the Constitution or otherwise to send unwanted material into the home of another.''

Odd forces have conspired to create paralysis in the government on the matter of spam. Corporate marketers and Internet traditionalists have found themselves in an accidental alliance. The marketers, particularly the powerful Direct Marketing Association, have lobbied hard to preserve their ability to send cheap messages to potential customers; ''self-regulation'' has been the industry's watchword. And the Internet's culture, too, lines up against government intervention. The word ''clueless'' might have been invented to describe legislators with an urge to meddle in the high-tech arena. In cyberspace, policy and rulemaking have come from the bottom up, and the benefits have been spectacular. Time and again, the online world has behaved like a self-healing organism, outwitting authorities who tried to impose structure from above.

But cyberspace belongs to the world of human beings, who rely on laws to discourage the worst behavior and to protect the powerless. The grass roots have not solved the problem -- indeed anti-spam posses have often caused trouble of their own, with blacklists that block mail from legitimate sources. And even the Direct Marketing Association has come to believe that spam hurts its members. ''I've got caught in the vicious cycle,'' says Regina Brady, an e-mail marketing consultant who works with the association. ''All of a sudden your e-mail address is spun out into cyberspace. This is a real problem for legitimate marketers trying to do the right thing.'' This fall, after fighting it for years, the association came out in favor of federal anti-spam legislation in some form.

Arguments about such legislation tend to focus on the issue of ''opt in'' versus ''opt out.'' In opt-out schemes, which the marketers favor, consumers have to take action to declare their unwillingness to receive unsolicited bulk mail. If the system is opt-in, then marketers have to be able to show that consumers have given their consent to receive solicitations. The European Parliament recently voted to adopt opt-in requirements, putting Europe far ahead of the United States in acting against spam.

''The reason it happens with impunity right now is that in fact it's not against the law,'' says James Love, director of the Consumer Project on Technology, a Washington-based advocacy group. He says he believes that making it possible to collect fines from spammers would change the balance of power significantly. He also says that the international nature of the problem need not be a barrier to effective action. ''Spam should be a good test case for cross-border consumer protection, because everybody thinks a spammer is lower than a sniper. Go into a treaty-type mode, where you try to get everybody to agree, from Korea to China to Turkey to Russia. You could build enormous pressure to comply with this.''

As remote as an effective solution seems, the spam problem might not be so intractable after all. The Telephone Consumer Protection Act of 1991 made it illegal to send unsolicited faxes; that law passed with strong backing from manufacturers of fax machines. It should be extended to include unsolicited bulk e-mail.

For free-speech reasons, any legislation should avoid considering e-mail's content; trying to define key words like ''commercial'' and ''pornographic'' only leads to trouble. And it isn't necessary. For that matter, even short of outlawing spam, two simple measures might be enough to stem the tide:

1) Forging Internet headers should be made illegal. The system depends on accurate information about senders and servers and relays; no one needs a right to falsify this information.

2) Unsolicited bulk mail should carry a mandatory tag. That alone would put consumers back in control; all the complex technological challenge of identifying the spam would vanish.

We need to be able to say no. No, I'm not looking for a good time. No, I don't want to ''e-mail millions of PayPal members.'' No, I don't want an anatomy-enlargement kit. No, I don't want my share of the Nigerian $25 million. I just want my in-box. It belongs to me, and I want it back.

James Gleick often writes for the magazine about technology. His next book, ''Isaac Newton,'' will be published in May.