BESIEGED BY SPAM
Junk e-mail can be "filtered" inexpensively, but the costs don't stop there.
By Tim Reason

From the Nigerian civil servant hoping to move millions of dollars to offshore havens (with your help) to pitchmen hawking herbs and procedures that promise improbable anatomical transformation, junk e-mails now waste a few precious minutes of everyone's day. Often referred to as "spam," this online corollary to telemarketing is more than just an annoyance - it may represent a serious financial challenge for your company. San Francisco based Ferris Research estimates that spam will cost US organizations a total of more than $10 billion this year in lost productivity and computing resources as well as the hard dollars spent on e-mail administrators and help-desk personnel. Those numbers do not include the cost of antispam filtering software, which, despite an annual cost of only about $5 to $10 per user, are used by less than 5 percent of companies with 10,000 or more employees.

Washington, DC-based National Cooperative Bank installed a software filter to block spam last year and saw its inbound e-mail volume drop by half. "I was just amazed," says Russell Schofield, managing director of IT. Even though the filter "works like a charm," it still doesn't catch everything. (One problem: since the bank is involved in the mortgage business, it's reluctant to block any e-mails with that as the subject, and low-rate mortgage come-ons are a spam staple.)

Analyst estimates of corporate spam don't range quite as high as Schofield's experience. Ferris says 15 percent to 20 percent of inbound e-mail at US corporations is spam. At that rate, Jupiter Research estimates that an employee will delete about 2,600 pieces of spam this year alone. Yet because Jupiter defines spam very strictly, the actual number of what most people would deem junk e-mail messages may be half again as high.

Moreover, while spam typically refers to unsolicited commercial e-mail, companies are realizing that so-called friends-and-family spam may soon be a problem of equal proportions. A survey conducted by Market Fact's e.Nation for filter-provider SurfControl Plc estimates that employees receive up to 30 chain letters, jokes, video clips, or similar e-mail messages from someone they know every week - more than 1,500 per year. While employees may want these messages, their attachments make them far bigger bandwidth hogs than commercial spam - and far more likely to introduce viruses or content that poses a liability threat to the firm.

Legislation has been proposed several times, and current bills before Congress may stand a good chance of passing if the flurry of lobbying activity by mail marketers is any indication. Until Congress acts, however, the best method for companies to combat spam is still a software filter.

Filters like those provided by UK-based SurfControl combine blacklists of known spammers, lexical methods (sniffing e-mails for certain combinations of words), and artificial intelligence to stop spam from reaching employee mailboxes. Filters have also grown more sophisticated - captured spam can be segregated into messages to be deleted, messages that are kept to be checked by humans, and, in the case of bandwidth-heavy friends-and-family spam, messages that are simply delivered after business hours. "The goal [of a filter] is the minimum amount of human intervention, but the maximum amount of accuracy," says SurfControl senior vice president for marketing Susan Getgood.

False Positives

Despite that sophistication, the possibility that legitimate e-mails (now dubbed "ham") can be snared by filters is a potential problem for companies. It's impossible to gauge the cost of so-called false positives, but they can certainly keep an IT department busy. When National Cooperative Bank first installed its filter, says Schofield, it blocked all e-mails sent to more than 25 employees. That generated complaints because it filtered out weekly e-mails about discount airline fares that some employees used to plan business travel.

Not surprisingly, e-mail marketers see false positives as a much more serious problem. Companies like Indianapolis-based ExactTarget, which provides software that enables companies to mount e-mail marketing campaigns and other bulk mailings, offer services that vet outgoing e-mail messages for phrases that are likely to run afoul of spam filters. At first glance, that would seem to make ExactTarget a spammer's accomplice.

Not so, says president Scott Dorsey. ExactTarget's clients must sign a contract stating that they abide by industry standard practices for "opt-in" e-mail marketing. Among other requirements, that means no rented lists. ExactTarget also vets the mailing lists its clients provide for "suspicious" e-mail addresses. Typically, this means addresses inserted into mailing lists by antispam organizations. The presence of such addresses, Dorsey says, indicates that lists are bad, or rented - grounds for terminating a client's contract. "We work only with e-mail addresses from customers who signed up on our clients' sites, or who have an existing business relationship with our clients," says Dorsey. ExactTarget recently joined forces with 18 other e-mail service providers to form the Network Advertising Initiative E-mail Service Provider Coalition to give a voice to providers that follow such procedures.

Colorado-based Assurance Systems, which offers similar services, estimates that 15 percent of "permissioned" e-mail was blocked by internet service providers (which often offer filtering as a value-added service to subscribers) or companies' own filters during fourth-quarter 2002. But, Dorsey admits, "the definition of 'permission' gets very, very stretched" by less scrupulous marketers. For corporations, the distinction is often meaningless anyway. "Some people complain, 'I'm being inundated with this stuff,' and then we find out they've subscribed to it," says Schofield.

Overall, he says, "office humor" between colleagues is sometimes snared, but it's rare for a legitimate incoming business e-mail to be blocked. Indeed, SurfControl's Getgood says it's important for filtering software to be flexible enough to let certain types of spam through. "Companies may have reasons to want to see spam," she says. For example, "they may want to review any spam that mentions the company's name."

A case in point: as this article was being written, an e-mail marked "Hasbro Offer" was sent sent to an e-mail address of CFO, CFO Asia's sister magazine in the US, by bulk e-mailer PremiumsMail.net. It offered a CD-ROM version of the game Monopoly. To find out if Hasbro had authorized the marketing effort, CFO forwarded the message to the corporate communications department of the Rhode Island-based company and followed up with a phone call. The call made it through but the e-mail didn't - it was apparently identified as spam by Hasbro's e-mail filters.

Hasbro spokesperson Stacey Roberts says the company doesn't use e-mail marketing and that all of its CD-ROM products were sold to Infogrames Interactive in January 2001. Infogrames vice president of US marketing services Gale Alles says the company uses e-mail marketing "as part of the mix," but only to customers that elect to receive such it. CFO faxed a copy of the "Hasbro Offer" to Alles (Infogrames's e-mail system also rejected it), who determined that the mailing was the responsibility of a third party that had bought the CD-ROM products for resale.

Given that some spam may cast your company in a bad light, a greater awareness of the risks, rewards, and actual mechanics of e-mail marketing is worth a closer look. As for its persuasive power, the aforementioned solicitations by those African "officials" have been so successful that the US Secret Service has established a special task force to respond - in some cases helping to extricate Americans who enter Nigeria illegally, believing they are about to consummate the deal of a lifetime.