How to Kill Spam Without the State
by Ari Armstrong, October 1, 2003
There is one achingly simple reason spam exists. It works. That is, some small minority of computer users actually pay for the stuff advertised by spam.
As I write, some dipshit is happily parting with his money, with visions of a longer schlong dancing in his head.
If we really want to stop spam with legislation, let's pass criminal penalties for those who provide the financial incentive for spam's existence. Getting suckered by spam is not a victimless crime. Send in the SWAT teams!
Anti-spam laws are great political maneuvers, as they let politicians preen their feathers without actually accomplishing anything.
A September 29 story in the Rocky Mountain News by Roger Fillion reports Governor Bill Owens "is gearing up to push anti-spam legislation." The article notes, "An anti-spam law enacted here in 2000 has proved toothless." That law let users sue in-state spammers unless they put "ADV" in the subject line of unsolicited spam e-mail and offered an opt-out. Fillion also mentions some people want a national "do-not-spam" list. Which, of course, in reality, would be a data mine for spammers.
Fillion reports, "California [recently] enacted the nation's toughest anti-spam law. It makes it illegal for individuals and businesses to send unsolicited commercial e-mail from California or to zap such e-mails to Californians. Penalties range as high as $1,000 for each unsolicited e-mail sent and $1 million for each 'campaign'." Of course, this will merely push spammers to work outside of California or use better technology to hide.
There's something more insidious about these laws: they will inevitably be used to punish Little Ol' Grandma who just sent out an e-mail for a church project that, by the way, happened not to fall within the scope of the non-profit laws. Fork over the fine, Granny, or at least hand over your home. Oh, but that's not what we meant! And prosecutors would never, ever apply the laws in obviously unfair ways. Not here in America. Especially against minorities, the poor, or those without a good lawyer on call.
It's simple economics. The real spammers, the ones causing all the problems, will be virtually impossible to catch. Punishing them would be enormously expensive. Thus, either the laws will be unenforced (most likely), or they will be enforced almost exclusively against low-level offenders who aren't responsible for the problems and who are likely to be computer "newbies."
The fact that some people spend money in response to spam and thereby perpetuate the problem is not, however, an explanation for why spam is so pervasive. The other simple economic reality is that, for the spammer, sending an additional piece of spam carries no additional cost. While people get all kinds of junk mail, nobody's calling for a "do not mail" list. (Of course, such a list might bankrupt a federal monopoly, and legal penalties can apply only to private businesses, not to the government, as we all know.) Similarly, "do not call" lists can meet with some success simply because, due to long-distance fees (especially across international borders), there is some marginal cost associated with telemarketing. Also, telemarketing requires one to hire people to interact on the phone who speak the local language. It's also a lot easier to hide the origins of spam than it is to hide the origins of a phone call.
Of course, it is private business that is actually doing the work of blocking spam. For instance, my server has installed filters that block a great deal of spam. Of course, these don't work perfectly. Quite a bit of spam gets through, and some items that aren't spam get blocked. For instance, I sent myself a copy of Fillion's article, and my server blocked it, on the following grounds: "X-IMAIL-SPAM-PHRASE: penis enlargement." I beat the blocker by -- you guessed it -- enlarging the "penis" with an extra letter, a trick spammers frequently use. I suppose this goes to show that, to some extent, spam is in the eye of the beholder. One person's spam is another person's informative news or opportunity to get laid.
I was thinking about this problem a few days ago, and I became perplexed by a simple irony. Most people who perpetually bitch about spam do absolutely nothing to stop it, even though it is within their power to help do so. It's almost as if complaining about spam has become a new form of entertainment. (It's certainly keeping the journalists in copy.) It's the new national distraction. "Yes, Iraq seems messy, and the federal deficit is disastrous -- but dammit this spam is sure pissing me off!" Perhaps this helps explain why so many people are so eager to do things that so obviously will not solve the problem. It's the political drama that matters, not the results. The great American pastime is passing the buck to politicians we know in advance to be essentially worthless for the problem at hand.
But there is a better explanation for why few people make any effort to impede spam, even though they have the ability to do so -- an explanation rooted (of course) in economics. Deleting spam from the mailbox is a relatively costless activity. I spend a few seconds hitting the delete key every day -- not a big deal. The real costs arise in the extra capacity servers have to buy to contend with the massive amounts of spam. The trouble is, if I make the effort to kill spam, it benefits me a little bit, but mostly it benefits other people. This is a classic case of the free-rider problem. Killing spam is to a great extent a public good. If everybody did what they could to kill spam, everybody's internet service would cost less. But no particular user has the proper incentive structure to take unilateral action.
The solution? We need an internet culture that encourages spam killers. That is, if the culture encourages spam killing and discourages shirking, fewer people will free ride off the efforts of others, and the overall level of spam will drop.
An article from PCWorld (brought to my attention by Brian Schwartz) reports the number one source of spam is the listing of e-mails on web pages. The number two source of spam is the listing of e-mails on usenet newsgroups. Interestingly, "e-mail addresses registered at e-commerce sites, posted to online discussions on Web sites, or listed as the contact for domains in the WHOIS database generated little spam." Perhaps this indicates spammers don't spend extra effort to target obviously sophisticated users.
It's obvious what to do about the #1 problem: people who run web pages should stop listing e-mail addresses in readily spammable form. I hereby announce a new policy for the Colorado Freedom Report: I will not post e-mails on the page except in graphic form (or with some other disguise). This creates a mild inconvenience in that users will have to type in the e-mail rather than merely hit the mouse button, but I figure if it kills just one spam, it's worth it. Slowly I will remove the e-mail listings on older pages. Also, individuals can encourage others with web pages to implement a similar policy. The idea is simply to not give spammers an e-mail mine.
Offhand, I'm not sure what to do about usenet groups. A person could set up a unique e-mail for use only for this purpose, but that wouldn't stop the spam from being sent, it would only establish a "spam only" e-mail account that need never be read. I suppose it would be possible to stop listing e-mails on groups or to disguise them as graphics.
I am interested in "challenge-response systems," but offhand I'm not sure they can solve the problem of forged addresses. Others have complained they are too costly to use. There is a lot of anti-spam software on the market, and one can choose to use a server with good filters.
Obviously, I'm not a techie. I must rely on the expertise of computer geeks to help me fight spam. I'm sure the experts will find my practical advice woefully inadequate, and I welcome their subsequent commentary. But I'm willing to become informed. I suppose that's the first step for all of us, as we seek to develop an internet culture than can kill spam.
We must also take personal responsibility to kill spam. We can't pretend the politicians will do it for us. Their incentive is to develop a cute re-election flyer, not solve the problem. If you're still tempted by the political approach, ask yourself one simple question: who is more technologically savvy, your average spammer or your average politician? There are steps each of us can take to kill spam, and to help foster a culture that encourages spam killing. Certainly we can discourage the idiots who fund the spam industry.
When somebody bitches about spam, our first question always should be, "So what have you done personally to reduce spam?" If the person's answer is nothing, that's an opportunity to educate and gently admonish.
Finally, let's not forget that spam is a wonderful problem to be faced with. After all, spam exists for some of the same reasons we love e-mail. The marginal cost of sending a useful e-mail is zero. ZERO. We can communicate regularly with people all over the world, instantly, at no marginal cost. This is a technology that is revolutionizing the planet. The fact that complete idiots -- the very ones who fall for the spam scams -- are now able to access a world's worth of information at the touch of a button, is a very healthy development. Are there problems? Yes. Is it perfect? No. Is it worth the hassle? Hell, yes. I mean, come on, people. I remember running a phone line from the kitchen to my 300 baud modem in my bedroom so I could call up an independent server a few miles away. If I wanted to connect with a server in another town, I had to pay long-distance fees. I'll take spam any day over that. Yes, there are ways to reduce the spam load, and those efforts are worthwhile. But as we're busy picking nits, we oughtn't forget that we live in a fantastic era, and we take for granted a technology that most of us couldn't even imagine when we were children.
To read more about this issue, see The Merry Spam Killers of Slashdot.