January 30th, 2009
Spam: You just can't win
For anyone even slightly optimistic about thwarting the never-ending crush of spam I have two words: Don’t bother.
At the Information Security Best Practices conference at Wharton at the University of Pennsylvania I’ve learned the following from the first panel.
Comcast’s Gerard Lewis, senior counsel and chief privacy officer, noted that the CAN-SPAM act of 2003 “hasn’t done anything to curb spam,” but is “a well intentioned law.” Indeed, almost all email is classified as spam.
Lewis should know since Comcast moves millions of emails a day–450 million on average to be exact. Lewis walked through the evolution of spam and how defenses have moved from generic filtering to a more sophisticated model. The rub: The fancy stuff doesn’t work too well either.
Lewis said that giving consumers more control and tools to prevent spam helps a bit. But plenty still fall for social engineering tricks.
What’s the solution?
I haven’t heard one yet. Chris Marsden, a professor at the University of Essex, said there are a bevy of regulation schemes being cooked up across the pond. But it didn’t sound like there were any spam killers coming from the UK.
Marsden said ISPs will likely see more regulation, but giving consumers more tools isn’t the answer per se.
“ISPs have made it clear that consumers will not implement filters,” said Marsden. Australia has even sent CDs to citizens to prod them to implement filters. One outcome may be required filtering for spam and content on all PCs as a regulatory requirement.
Think of these efforts as mandatory seat belt laws for Web surfing.
Update: In a followup conversation, Lewis said the biggest issue with laws like CAN-SPAM is that it doesn’t reach overseas where a huge chunk of the spam originates. Carol DiBattiste, senior vice president of privacy, security, compliance and government affairs at Lexis-Nexis, spoke about a different topic, but the solution sounds a lot like what the folks in the Talkbacks below are seeing. Lexis-Nexis as part of its security policy blocks international IP addresses.
Larry Dignan is Editor in Chief of ZDNet and Editorial Director of ZDNet sister site TechRepublic. See his full profile and disclosure of his industry affiliations.
For daily updates, follow Larry on Twitter.
Subscribe to Between the Lines via Email alerts or RSS.
