The Spam Wars

How should the Internet deal with junk mail?

Wendy M. Grossman from the November 2003 issue

(Page 3 of 3)

The ultimate problem with legislation is that spam is a global problem, not a state or federal one. A patchwork of conflicting laws will do nothing to improve the ease of use of e-mail communications. None of the laws so far passed have diminished the amount of spam flooding the Net. Lawrence Lessig, a Stanford law professor and the author of Code and Other Laws of Cyberspace, believes the problem is enforcement, and his proposal is for the government to pay a bounty to any geek who can track down and identify a spammer. He's even offered to quit his job if this scheme is tried for a year and fails.

The Usenet Experience

There's one more approach to the spam problem that we should consider. For the lack of a better term, we might call it the community solution. Alternatively, we could call it the Usenet approach.

Created in 1979, Usenet is in many respects still the town square of the Internet. It played that role even more in 1994, when the Web was still in its "before" stage and two Arizona lawyers, Martha Siegel and Laurence Canter, sent out an infamous spam advertising their services, provoking a furious reaction. The technical method used to post the message meant that you couldn't mark it read in one newsgroup and then not see it in the others, so anyone reading a number of Usenet newsgroups saw the message in every single group.

When the uproar eventually settled, a new hierarchy of ad-friendly newsgroups was created, each beginning with the prefix "biz." But this approach never really worked, because the kind of people who advertise anti-cellulite cream, get-rich-quick schemes, and cable descramblers don't care if they annoy people; they just want maximum eyeballs. In the ad hoc newsgroup news.admin.net-abuse. usenet, users and administrators discussed and developed a system that took advantage of the cancellation features built into Usenet's design. These are primarily designed so people can cancel their own messages, but a number of public-spirited people hacked them so third parties could use them to cancel spam.

By now spam has died out in many newsgroups, partly because the system worked and partly because the spammers simply moved to e-mail's wider audience. But the worst spam period cost Usenet many of its most valuable and experienced posters, who retreated to e-mail lists and more private forms of communication and have never come back.

The key to making this system work was community standards that defined abuse in terms of behavior rather than content. Spam was defined as substantively identical messages, posted to many newsgroups (using a threshold calculated with a mathematical formula) within a specified length of time. The content of the message was irrelevant. These criteria are still regularly posted and can be revised in response to community discussion. Individual communities (such as newsgroups run by companies or ISPs) can set their own standards. It is easy for any site that believes canceling spam threatens free speech to block the cancels and send an unfiltered newsfeed.

The issues raised by Usenet spam were identical to those raised by junk e-mail today. The community, albeit a much smaller one, managed to create standards supported by consensus, and it came up with a technical scheme subject to peer review. A process like this might be the best solution to the spam e-mail problem. The question is whether it's possible given the much more destructive techniques spammers now use and given the broader nature of the community.

Some working schemes for blocking spam are based on community efforts -- in which the first recipients of a particular spam send it in, for example, so it can be blocked for other users in the group. In addition, the Net has a long tradition of creating tools for one's own needs and distributing them widely so they can be used and improved for the benefit of all. As in the Usenet experience, there is very little disagreement on what spam is; that ought to make it easier to develop good tools. I can't create those tools, but I can offer less technical friends a spam-filtered e-mail address on my server, which has SpamAssassin integrated into it (after a month of work to get it running), to help them get away from the choked byways of Hotmail or AOL. If everyone with the technical capability to run a server offered five friends free, filtered e-mail, many consumers would be able to reclaim their inboxes. Some ISPs are beginning to offer -- and charge for -- such a service.

In the end, the ISPs are crucial to this fight. In the Usenet days, system administrators would sometimes impose the ultimate sanction, the Usenet Death Penalty -- a temporary block on all postings from an ISP that had been deaf to all requests to block spam sent from its servers. It usually took only a couple of days for the offending ISP to put better policing in place -- the customers would demand it. That's what the Realtime Blackhole Lists do, constructing their databases of known spam sources from pooled reports. But the bigger and richer ISPs, such as Hotmail and AOL, can take the lead by taking legal action, as they are beginning to do. AOL filed five anti-spam lawsuits last spring alone.

The Usenet experience shows that the Net can pull together to solve its own problems. I don't think we're anywhere near the limits of human technical ingenuity to come up with new and more effective ways of combating spam, any more than I think e-mail is the last electronic medium that spammers will use. (There have been a couple of cases of "blogspam," where robot scripts have posted unwanted advertising to people's blogs.) The problem of spam may be a technical arms race, but it's one that's likely to be much easier to win than a legislative arms race.

When I spoke with Danny Meadowes-Klue, head of the U.K.'s Interactive Advertising Bureau, he told me, "Spam is the biggest threat to the Internet." But he didn't mean what you think he meant. He was talking about the destructiveness of so many efforts to stop it.