State Affairs: Filters Conflict With Government OpennessState Affairs: Filters Conflict With Government Openness

Government agencies got a bit of a free ride from spammers, who worried that the government might go after them if they blasted their workers' in-boxes.

No more. Now the public sector faces a similar onslaught, yet it needs to allow unrestricted, large-scale public E-mail access while filtering out junk messages. "We have to balance the rights of citizens to reach us while getting rid of spam, which has become a serious problem," says Missouri CIO Gerry Wethington.

Wethington, who's also president of the National Association of State CIOs, says it's only in about the last 15 months that spammers have started inundating state agencies.

Fighting spam and the viruses it carries has become a priority for David Jordan, chief information security officer for Arlington County, Va. Jordan has about 3,500 users at 20 agencies, and some individuals receive hundreds of spam messages a day. So Jordan began filtering subject lines, which caught 30,000 to 40,000 unwanted messages a day. He helped the process by asking users to employ "government-ese" words and phrases in their subject lines, which are then placed on a "whitelist" to prevent them from being filtered.

Next, he blocked some Internet service providers known to harbor spammers and added a heuristic engine from Symantec Corp., which helped block spam from "bad" IP addresses.

He also took the extreme step of phoning legitimate companies such as retailers and telling them not to market by E-mail to the county's employees.

One reason to get more serious: Spam and viruses are becoming linked, says Chris Miller, group product manager for E-mail security at Symantec, as virus writers use spam techniques to distribute their malicious wares.

To keep spammers from harvesting E-mail addresses, some agencies use role-based E-mails in their Web sites, which solicit E-mails from citizens but only offer generic E-mail addresses. Another tactic is to use "contact boxes" in which the public writes messages to the agency in a pop-up box and no recipient's E-mail address appears.

The Federal Trade Commission gets bombarded by spam from those "who disagree with their anti-spam activities," as deputy CIO Bill Marsh politely puts it. But the agency keeps its E-mail, phone, and fax number on its Web site. "We're a government agency," he says. "We have to be open."

Illustration by Peter Horvath

Return to main story: Spam Nation