Laws can't fight spam without tracking down spammers, say tech firms


Laws can't fight spam without tracking down spammers, say tech firms

By Robert Mullins Silicon Valley/San Jose Business Journal

Nov. 3 — New laws may provide new weapons to punish spammers but they won't work unless there is a way to actually find the spammers, Silicon Valley spam fighters say.



Latest local business news Silicon Valley/San Jose Business Journal home page Book of Lists: Top local leads Search Silicon Valley/San Jose Business Journal archives Subscribe Now

Computer network security firms now devoted to just detecting and blocking spam are shifting to also find its source. One such approach identifies Internet Protocol addresses of trusted servers, while another traces a globetrotting e-mail as it bounces from server to server around the world.
But while companies have technology to track down senders of unsolicited commercial e-mails, or spam, some solutions aren't quite ready, others aren't reliable, and still others only go so far. New laws enacted in California and pending in Congress impose criminal penalties on spammers but some observers doubt spam would be a high priority with law enforcement agencies fighting violent crime, terrorism and other illegal acts.
On top of all this, experts say, these so-called rogue spammers remain a cunning group able to outfox their pursuers.
"Even if you trace the spam, it's useless if you try to prosecute these people because then you are trying to track down some rogue spammer who's overseas and who's a moving target anyway," says Eytan Urbas of Mailshell.com Inc., of Santa Clara, a maker of anti-spam products and software development tools to create other spam-fighters.
Still, many anti-spam activists say eliminating the problem of annoying, unwanted or even offensive e-mails requires a combined government and technological response.
The government response came from California where an anti-spam law takes effect Jan. 1 that provides criminal penalties of as much as $1,000 per spam and also lets citizens sue spammers in civil court. On the federal level, the U.S. Senate on Oct. 23 unanimously passed an anti-spam law that includes some of the same provisions found in the California law. But the legislation still has to pass the House, a move that is not certain.
But even if spamming is made illegal, Mr. Urbas thinks enforcement may still be a problem.
"Are you going to send the sheriff to this guy's home?" he asks.
"The local police and sheriffs are a little too busy to track down your local spammer."
But other companies do report working successfully with law enforcement to track suspected criminals through e-mail and the Internet.
Network Associates Inc., maker of the McAfee line of security software, has worked with the FBI, the U.S. Postal Inspection Service and the New York Police Department to track, through their e-mail, people who are under investigation, says Bryson Gordon, chief spam prevention officer of the Santa Clara firm.
McAfee has software that displays on a screen a world map tracing the point-by-point trip the e-mail took -- San Jose to Toronto, to Istanbul to Florida -- but it can trace it only as far back as the Internet service provider to which the spammer subscribes. McAfee turns the information over to law enforcement agencies to investigate further, Mr. Gordon says.
"We cannot trace it back to the person sitting in front of their computer," he says.
Other security companies are working on technology that, while it doesn't identify the sender, at least gives spammers fewer places to hide.
CipherTrust, an enterprise network security firm, is a member of the Anti-Spam Research Group, a nationwide task force developing technology to stop spam. It is expected to report major advancements in spam tracking in the next 12 months.
One solution identifies legitimate e-mail senders by the IP addresses of the e-mail servers it uses, says Paul Judge, chair of the task force and chief technology officer of Atlanta-based CipherTrust, which has an office in San Francisco.
A legitimate e-mail sender -- say, Amazon.com -- uses specific servers for sending out e-mail.
Each server has its own Internet Protocol address -- a kind of digital serial number.
If an e-mail comes along that has the domain name Amazon.com, but not one of those IP addresses, then it is suspected spam, says Mr. Judge. Spammers often take the identity of another server, a tactic called "spoofing," to disguise themselves.
"It gives you a simple message to check with Amazon ... and see if this IP address is one of [Amazon's] trusted systems or not," he says. "This moves spammers into more of a corner."
But other anti-spam technology can backfire, says Ray Everett-Church, of Fremont, cofounder of the Coalition Against Unwanted Commercial E-mail, a nonprofit group.
Many ISPs have a spam reporting service for subscribers. If they get spam, one click and a complaint e-mail is automatically sent to the ISP, which writes back acknowledging the complaint and providing a link to the CAUCE Web site for more information.
But the e-mail directing them to CAUCE is itself identified as spam.
"About two or three times a day, I get a message back from one of these automated programs saying I received spam advertising your site," Mr. Church says.
"Tracing a piece of spam ... is an important part of fighting spam. But my concern comes in automating that process," he says.
And ironically, an Oct. 28 news release about fighting spam e-mailed to the Silicon Valley/San Jose Business Journal from the Internet service SBC-Yahoo was itself identified as spam by the paper's e-mail system.
Developing the technology to track spam "would take a paradigm shift" in the network security industry, says David Perry, global director of education for TrendMicro, a Japanese security firm with an office in Cupertino.
To date, spam fighting efforts have been just focused on identifying and blocking spam, says Mr. Perry, who is based in Huntington Beach. Tracing it is a whole different approach.
"I haven't heard any demand for tracking it," he says.
Any technology that disrupts spammers by arresting them, suing them or ruining their business model is a good technology, spam-fighters say.
Charging one cent to send each e-mail would put spammers out of business immediately, says Bob Blakely, chief scientist on security and privacy at the Tivoli Software division of IBM Corp., who was in San Jose for a conference.
If it costs a spammer $10,000 to send out 1 million e-mails, the spammer could not afford to send them.
"You need to eliminate the economic incentive to send spam," says Mr. Blakely, though he admits there would likely be a huge public outcry to paying for e-mail.

Three Arch fund closes at $450M

Tech showdown in Texas

Local news from around the country