Outsmarting SpamOutsmarting Spam

The fight against spam doesn't promise to ring up more revenue or slash the costs of doing business. But make no mistake: Fighting spam has become a priority for most businesses, and the backlash is leaving business-technology execs with no choice. They must fight the battle or suffer the consequences--maybe both.

The results of a new information Research survey make it clear that not everyone is gearing up for all-out war. Just over a third of 550 business-technology executives say eliminating spam is a high priority in their companies. The majority say it's a moderate priority, but maybe that's because they're so busy with more mission-critical IT projects. Or maybe they haven't yet heard from senior executives demanding that spam be kept out of their in-boxes. "If you don't get it under control, it's a very visible problem," says Lowell Mattox, VP of internal technology at MasterCard International. "You can get black eyes on this in a hurry."

Get out the ice packs and raw steak. Only about 25% of respondents say their companies have extremely effective spam-filtering controls. More than half don't even track how much spam comes in the door, but 86% of respondents who do track it say the situation is getting worse every month. For example, in July, half of MasterCard's 800,000 inbound messages were tagged as spam, compared with one-quarter of 400,000 messages in February, Mattox says. That's a fourfold increase in spam volume.

The rise in unsolicited, unwanted E-mail will only increase the burden on E-mail servers--and drive up operational costs. On average, survey respondents from large companies say that almost 30% of their server resources are devoted to processing spam. The Radicati Group, in a just-released report, estimates a company with 10,000 employees that lacks spam-fighting tools will spend $49 per user this year on server resources to handle spam, compared with an average of about $25 per user for those with spam-filtering software. Server costs will rise to $257 per user by 2007, Radicati predicts. "It's a very hidden cost at this point," says senior analyst Masha Khmartseva. "It's going to be more important for IT execs to deal with this problem."

Organizations will have to add more servers as the volume of E-mail grows over the next four years, the Radicati report says, and as many as half of new E-mail servers added in large companies could wind up solely as "spam servers."

Smaller companies aren't immune to the problem: The growth of junk E-mail recently forced Berlin Packaging, a $200-million-a-year maker of bottles, jars, and other packaging, to upgrade its Microsoft Exchange 2000 E-mail server to a more powerful configuration. The company, spurred by increasingly urgent requests from senior execs, deployed a Symantec Corp. SMTP gateway last month to help get a handle on unwanted E-mail. Spam is tagged when it's delivered to employee in-boxes--CIO Steven Canter has even configured his PC to yell "I hate spam!" whenever one of the dreaded missives arrives. The unwanted messages will soon be routed to a quarantined location on the network. Admittedly, no one's got the perfect solution--technical or legislative--to fight spam, which may be tempering enthusiasm for an all-out war against it. Half of the respondents to the information survey say they believe spam has become a permanent part of 21st-century life. Those who don't monitor it cite the ineffectiveness of filtering technology and the speed at which spam techniques change among the reasons for not paying closer attention to spam E-mail volumes. But Michael Osterman, principal analyst at messaging research firm Osterman Research, says anti-spam technology has gotten noticeably better in the past year and that overall satisfaction with anti-spam tools is on the rise. (For more on spam-fighting tools, see the Tech Guide.)

Things have gotten better at MasterCard since the company fine-tuned its CipherTrust Inc. IronMail gateway appliance to protect its 5,500 employees from spam and viruses. Initially, MasterCard had IronMail configured to filter too aggressively, resulting in too many valid messages being incorrectly tagged as spam. But after tinkering with the filtering settings, the company is "reasonably happy" with IronMail, Mattox says. The software identifies spam using a combination of rules-based heuristics (a process of analyzing spam to discern its characteristics and then using that information to determine the likelihood that future messages are spam), known-spammer blacklists, and message scoring.

There's some frustration that efforts to contain the stuff may take away technology resources from other priorities. In large companies, IT departments can spend almost 10% of their time implementing filtering software, according to the information Research survey. Mattox has one person from his eight-person messaging staff focus full-time on spam and longs for the way things were a couple of years ago, before spam began competing for budget dollars and distracting his staff from its core objectives. "It would be nice if we could just fix hard-drive crashes and dead network ports," he says. "It was so simple then."

Berlin Packaging's Canter would rather devote his time to more important matters. "It's something we didn't ask for," he says of the battle against spam.

Beating back spam is "certainly not in the same class as using IT to increase sales and customer satisfaction at our pizza stores," says Peter Wagner, senior director of information systems at Domino's Pizza LLC. But when E-mail-savvy CEO David Brandon started chiming in on the problem, Domino's attention to spam intensified. If your executive team thinks it's a priority, "then of course it becomes a priority for IT," Wagner says. Domino's has been evaluating anti-spam vendors, and at least one product in testing for five months looks like a keeper: IntelliReach Corp.'s MessageScreen spam-filtering software.

There are ways around getting internal IT staff too caught up in the spam wars. Eighteen months ago, Stephen McCabe, senior VP and co-CIO of Daiwa Securities America, saw that the increase in spam would aggravate the compliance burden at Wall Street firms, which were already dealing with stricter regulations that require them to audit and archive E-mails. So he signed up Daiwa with MessageLabs, an anti-spam service that scans all inbound E-mail for the company at a location outside the network. Of the 7,000 inbound E-mails Daiwa receives each day, MessageLabs tags 43% as spam. That's a huge volume of messages IT no longer needs to audit and archive, McCabe says. Now, "we actually don't think about spam anymore."

But Daiwa is ahead of the game, McCabe says, and he should know. In addition to his role at Daiwa, he's chairman of the Securities Industry Association's data-management committee, a group of IT execs from brokerage firms who meet regularly to share knowledge related to technology issues. Surprisingly, many of the normally security-conscious firms that make up the association's membership have no spam protection, McCabe says. He's trying to attract more members to the data-management committee to spread the word that firms need to address the situation.

There is the potential for glory in the spam fight: IT groups that conquer the problem may win senior executive support for other projects. "Most people don't notice the IT organization until something bad happens," Berlin Packaging's Canter says. But down the road, the company's executive leadership will factor in the success Canter and his team ultimately have in combating spam when it comes time to allocate budget dollars for future IT projects. According to the information Research survey, that success may be measured in a number of ways: 86% expect improved productivity; 76% see a reduced demand on mail servers; 71% cite improved security; and 41% expect reduced liability related to potential hostile workplace claims from offensive spam.

And then there's just plain old user happiness, the result of not having to wade through a mountain of in-box spam mails. Says Canter, "The next time we need something, we can say, 'Hey, we've got another idea that will make our users happy.'"

Contine to the online sidebars: How To Get Serious About Fighting Spam and Lost In Cyberspace: Containing Spam