Origin of 'spam'

The term for unsolicited bulk e-mail originated on newsgroups for messages that were repeated across several groups at once. It reminded internet users of a sketch by British comedy troupe Monty Python in which "spam" is repeated over and over, and sung by Vikings. Watch the sketch on Google Video.

In its mildest form, unsolicited commercial e-mail, or spam, is annoying, cluttering your inbox. At its worst, it can plant viruses, spyware or Trojan horses.

"Spam is a huge business. It's all profit driven. They're getting out millions of pieces of marketing propaganda a day at little or no cost," says Tom Copeland, president of the Canadian Association of Internet Service Providers.

The latest development, Copeland says, is that spammers and virus writers have joined forces: "We're seeing computers infected with worms or viruses that turn them into spamming devices, or what we call spam zombies."

The first spam message

In April 1994, Arizona lawyers Lawrence Cantor and Martha Siegel sent out a message to all 6,000 newsgroups on the internet offering anyone who replied assistance in getting a U.S. green card.

They later published a book How to Make a Fortune on the Information Superhighway.

Spam zombies are infected computers used by spammers to send out a few or thousands of pieces of e-mail. Home users with compromised systems are unlikely to realize they're part of a spamming network. What they may notice is that their machine is slower than normal.

The vast majority of the world's spam comes from personal computers infected with viruses that transmit spam without the owners' knowledge, according to anti-virus company Sophos.

"Right now, the biggest problem that we have on the internet are literally tens of millions of infected home computers," says Neil Schwartzman, president of the Canadian Coalition Against Unsolicited Commercial E-mail (CAUCE).

Copeland points out that ISPs (internet service providers) spend millions of dollars a year to prevent spam from getting to the user. Abuse of e-mail forces the ISP to increase its bandwidth, hire more customer complaint staff, and install new technologies for filtering and managing the ever-growing volume of e-mail.

Top 12 sources of spam (Nov. 6, 2006)

1. United States
2. China (including Hong Kong)
3. France
4. South Korea
5. Spain
6. Poland
7. Brazil
8. Italy
9. Germany
10. Taiwan
11. Israel
12. Japan

Source: Sophos

This cost ends up getting passed on to the home user, Schwartzman says. "The cost of spam to consumers? Their computers are getting inundated and infected, and $5 a month of your ISP bill goes to fighting spam."

The Messaging Anti-Abuse Working Group, an international messaging industry group, released a study in March 2006 suggesting that 80 to 85 per cent of e-mail was "abusive": spam, viruses or denial-of-service attacks.

Security firm IronPort reported that the worldwide spam volume was 61 billion messages per day in October 2006.

Security experts also warn of the recent rise of a common type of spam called "phishing," which can cost consumers their privacy. Phishing can lead to theft of a user's personal details such as credit card numbers or banking information.

Another recent trend is seeing a rise in spam containing embedded images instead of text, because text can more easily be detected and blocked by anti-spam software. Many e-mail programs will automatically display embedded images. Computer security company Sophos said in November 2006 that image spam accounted for nearly 40 per cent of all spam.

The government's role

Anti-spam laws around the world

• U.S.: CAN-SPAM Act of December 2003.
• Australia: Spam Act 2003 came into effect April 2004.
• U.K.: Came into effect December 2003.
• European Union: Directive on privacy and electronic communications came into effect October 2003.
• Italy: June 1999, first in Europe.

There's no regulatory body dictating operational issues to the ISP industry, though it's common practice, says Copeland, for most ISPs to provide abuse addresses for users to send spam to.

As for what the government's role is in the battle against spam, Copeland says Ottawa's struggling. An anti-spam task force set up by Industry Canada recommended in its May 2005 report vigorous enforcement of existing Canadian laws and creating new ones to fill in any gaps.

"Sixty per cent of all spam is fraudulent in nature," says Copeland, who sat on the task force. "We have the Competition Act that would deal with false, misleading information such as those purporting to increase body parts' size. Companies must have data to prove their claim. They're required by law before they start marketing."

The other existing law that could be used to fight spam, according to Copeland, is the Personal Information Protection and Electronic Documents Act, also known as PIPEDA. Under it, e-mail addresses are considered to be private and personal information. Companies are not allowed to harvest or use addresses without permission from the customer.

How to fight spam

Protect your computer:

• Install up-to-date anti-virus, anti-spam software and a firewall.
• Verify attachments with senders. Scan for viruses before opening.

Protect your e-mail address:

• Keep one e-mail address for your trusted personal and business contacts. Use a separate, disposable e-mail address for other online uses.
• Don't post your e-mail address anywhere on the web. That will only attract spam.

Protect yourself:

• Delete spam.
• Don't open, don't buy, don't click in any links and don't reply to spam. This will help prevent you from receiving more spam in the future.
• Never respond to e-mail inviting you to be taken off their list. This only confirms your address is active and makes your e-mail address even more valuable.
• Don't be "phished" in. Phishing is fraudulent e-mail designed for identity theft.

Source: Stopspamhere.ca

In 2003, the U.S. introduced the CAN-SPAM Act (Controlling the Assault of Non-Solicited Pornography and Marketing Act). Critics say that the major problem with the U.S. law is that it requires users to "opt out" of spam. Consumers have to receive the e-mail first before they can tell it to go away.

That's not the route Copeland wants Canada to follow: "Anti-spam laws won't make spam go away. What they showed in the U.S. was that there was more spam. What it did was legitimize a certain type of spam."

Copeland says he's not yet convinced Canadians need a spam-specific law. He thinks that if a law should be pursued, it should include other cyber crime: "The crime should be infection not specifically spam itself. If we get to the point where existing laws aren't sufficient, forget about targeting small parts of internet nuisances. Look at the big picture. Follow the money. Who's benefiting from it?"

Neil Schwartzman, who also sat on Canada's special task force on spam, has a different take on legislation and spam. While he agrees with Copeland that the law in the U.S. basically legalized spam, he thinks the government has a responsibility toward legislation: "There's no one solution to spam. We're not going to find a law that is going to stop murder any more than it's going to stop spam. What it does is allow us to punish those who do spam and dissuade a lot of us from doing it, as well."

"We're the only industrialized country in the G-8 that doesn't have a law against spam. We need a specific anti-spam law." Schwartzman wants Canada to pattern its future legislation on Australia's spam act, which threatens to fine professional spammers up to $1 million a day. Supporters of the law say that since the legislation came into effect in April 2004, the country has seen a reduction in spam to Australians by Australian spammers. Schwartzman points out that home users have to realize what spam is costing them and that they have to take action.

A lot of users install anti-virus programs and figure that's the end of their problem, and the end of their responsibility, says Copeland. "When you buy a motor vehicle, GM is not responsible for the ongoing safety of your vehicle. Your computer's the same. Users have to see it that way. Not only can your computer be used as a spam zombie, but your computer could be used to send damaging data. People are not getting readily available and easily implementable solutions."

[an error occurred while processing this directive]