Damming The Spam Deluge

pam is a huge problem for big corporations, but it doesn't discriminate. Small businesses and midmarket companies are as afflicted by unsolicited e-mailed pornography and get-rich-quick schemes as the big guys. And they have fewer internal IT resources to deal with it.

We all know the pitches from alleged Nigerian doctors seeking financial help, from those looking to sell teeny, tiny remote-control cars, or from those offering to help protect your PC against viruses. These messages cram our e-mail boxes. They take up storage space and suck up bandwidth. And they eat up untold hours of worker productivity, even when employees delete them without opening them. Researcher Ferris Networks estimates that the cost of spam to U.S. businesses,including lost productivity time; the purchase of additional servers, storage and bandwidth; and the cost of IT staff time spent eradicating spam,approaches $9 billion a year.

Unlike huge enterprises, SMBs typically "don't have layers of servers" to deal with mail routing and antivirus and spam control, said Alan Lepofsky, offering manager for messaging solutions at IBM's Lotus Software group. These businesses typically use one server to carry the whole load, he said. In response, Lotus has added more server-side spam control options to Domino 6, including integration with leading "realtime black hole" lists (RBLs) to keep spam from reaching recipients' mailboxes. Microsoft has promised similar capabilities for its upcoming Exchange Server update, code-named Titanium, due next year.

Still, the fact that resource-constrained midmarket companies are as hindered by spam as larger enterprises means they need a third party to dam the unwanted flood. And that means integrators or solution providers with the right expertise can garner incremental business in existing accounts or gain net-new business, solution providers and analysts say.

Spam may be a proportionally bigger problem for large enterprises, but smaller companies are encountering the problem more frequently, said Steve Finnestead, account executive at Engineering Computer Consultants, a Fort Collins, Colo., integrator. "We're seeing more and more specific calls for help on this problem of junk e-mail," he said.

Andy Vabulas, president of IBIS, an Atlanta-based solution provider, said his customers are increasingly aware of spam,and its costs. "One client realized that his employees were taking 30 minutes a day cleaning out spam from their mailboxes," Vabulas said.

It's not hard to figure the economic reasons behind the junk-mail flood. Ferris Networks estimates that because e-mail, unlike physical mail, incurs no "postage" charge per se and racks up a 0.1 percent response rate, a spammer could earn $10,000 free and clear from blanketing the universe with 10 million electronic messages for a product with a $1-per-unit profit margin. (Note: Some spammers contend that their success rate is a much higher 1 percent, meaning the same mailing could net a $100,000 profit.)

Clearly, no one is safe from this menace. Even VARs and ISVs that specialize in e-mail-related business are at the end of their ropes. They feel their customers' pain because, well, they too get spammed.

Barry Baker, COO and CTO of eOptimize, a Microsoft ISV partner in Kamloops, British Columbia, found that 25 percent of the e-mail he received in the last two weeks of November 2002 was spam. "That doesn't include anything that might be remotely useful or even any targeted mailings,which are also unsolicited but originate from a source from which I have purchased or accessed content or products in the past. If that was included, the number would be closer to 40 percent," he said.

Such spam is "a growing impediment to executive workflow, including my own," Baker said, adding eOptimize is evaluating solutions, including a hosted spam/virus filtering offering.

Integrators and solution providers say spam presents an opportunity to win more business in existing accounts or be the hero with a new customer. "Spam is an easy way for us to get into large organizations or any organization," Finnestead said.

But spam control has to be carefully implemented. The only thing potentially worse than receiving reams of unwanted ads is not getting the messages you want and need to do your job. "False positives are a huge issue. People worry about not getting the mail they should, so they tend to allow way too much mail through and then productivity goes down," Finnestead said.

Engineering Computer Consultants partners with SurfControl to offer spam control, he said. Meanwhile, IBIS offers Trend Micro's ScanMail for antispam measures, Vabulas said.

"Many medium-size companies already have some sort of content filtering or virus filtering in place that can be extended to also filter for spam. Unfortunately, typical content- and virus-filtering vendors don't yet have effective antispam solutions," said Marten Nelson, consulting research analyst at Ferris Networks. "Now there are new antispam solutions announced every week."

The highly fragmented market makes it difficult for organizations to find what they need, and that creates an opportunity for resellers and systems integrators."

It also opens the door for outsourced filtering, which resellers may offer themselves or in partnership with ISPs, Nelson said.

Even Brightmail, a San Francisco spam-fighter that made its name selling its services to large ISPs and corporations, is recruiting regional solution providers to bring its expertise to smaller companies. Brightmail relies on sentries posted around the Web to sniff out and identify spammers in near-realtime, and sends out alerts to its customers, updating their RBLs continually. Brightmail's customers include huge ISPs such as AT&T Broadband Internet, and the company is targeting EDS and IBM Global Services for global coverage in large enterprise accounts.

Mike Conner, vice president of worldwide sales at Brightmail, said the company is continuing its two-month-old recruitment push for solution providers with security and related expertise to attack the midmarket. Brightmail wants its solution provider partners to go beyond traditional license sales arrangements and offer such value-added services as vulnerability assessment. Conner said Brightmail wants to have 35 such partners signed up in North America by the end of the first calendar quarter. "The goal is quality, not quantity," he said.

The time is ripe, Conner said. "I think 2002 was the year of spam and 2003 will be the year of antispam. Companies are going to start spending money fighting this," he said.

Brightmail's ISP relationships could be a boon to solution providers and their smaller customers. "Because of our close ties to ISPs, we know about threats soon after they happen," Conner said.

SurfControl, an antispam leader based in Scotts Valley, Calif., is also recruiting qualified resellers and integrators to fight the spam scourge and has added more than 70 such partners to its program in the past few months.

"Spam is high on the [list of] annoyance factors. ... We get a lot of requests for help in managing it or hopefully eliminating it or at least cutting it back," said Gavin Livingstone, president of SurfControl partner Bryley Systems, Hudson, Mass. The bulk of Bryley Systems' customers have 75 to 150 PCs, he said.

The key to success is spending time in advance to tweak the process, Livingstone said. One of Bryley Systems' larger midmarket customers, a bank, is now able to filter out more than 50 percent of its incoming mail, he said. In the first three months, nearly 11,000 of 20,000 messages were blocked. The network administrator there spends about a half-hour a day walking through the filtered messages to make sure no good messages were mistakenly rerouted, Livingstone said.

Some industry observers believe that the advent of spam is unthwartable and will lead to a tiered communications infrastructure that includes public e-mail, which will become the equivalent of the pile of junk direct mail, circulars and catalogs you stack up at home and barely look at, and a more private, secure higher-level communications channel. That channel could include standard instant-messaging technology or premium products from companies such as Groove Networks and could be the place people turn to for priority messages. In such situations, people would be able to delineate their own communities and keep outsiders out.

Even antispam vendors admit that the solutions are imperfect thus far. Spammers may be many things, but idiots they are not. They're able to mutate their online identities and messages to thwart any number of content- or address-filter controls.

EOptimize's Baker is philosophical about the problem. "Realistically, I don't expect that any tool or process will be infallible. Spam is ugly and getting uglier, so I suspect we won't see the end of it until e-mail itself becomes obsolete."