Nash Networks Inc. IT Consulting
Strangling the Internet: Why Spam Matters and What it Costs

Strangling the Internet: Why Spam Matters and What it Costs

March 2009 "Making every IT dollar count!" Part 3
Copyright Nash Networks

Strangling the Internet:
Why Spam Matters and What It Costs
Click here to download
PDF version
PDF Version

Executive Summary


The cost of spam

  • The main cost of spam to businesses is lost productivity, mainly attributable to time spent reviewing spam.
  • Other costs are due to lost or delayed e-mails, viruses transmitted through spam, anti-spam technology, and extra support, storage and bandwidth.
  • The total cost of spam to companies is estimated by research groups to be about $750 per user per year.
  • User education to help employees handle spam more efficiently may save more than technical solutions.

Delete or quarantine?

  • It takes 62% more time to track down missing or deleted legitimate e-mails than to review possible spam e-mails in a quarantine folder.
  • Lost e-mails can also be very costly in terms of missed meetings or lost opportunities.
  • A less aggressive spam filter that quarantines e-mails is preferable to one that aggressively deletes suspected spam.

Scary spam stats

  • In 2008, spam made up 70% of all e-mails sent - 53.8 trillion a year or 101 per user per day.
  • Only about 20% of all e-mails originate from known legitimate servers.
  • Spam is predicted to cost $130 billion worldwide in 2009.
  • Most computer viruses are now designed to hijack computers to send out spam – turning them into so-called spambots.
  • Up to 25% of computers (150 million plus) could be bots.


E-mail us
if there are any other topics you'd like to see covered, or subscribe to our newsletter:

Email Newsletter icon, E-mail Newsletter icon, Email List icon, E-mail List icon Sign up for our Email Newsletter
For Email Marketing you can trust



How Big is the Problem?

In the early 1990s, Paul Nash, now President of Nash Networks, was among a group of Internet pioneers who vociferously objected to the intrusive new phenomenon called “spam”. They worried that it would change the Internet irrevocably and for the worse. Turns out they were right.
  • In 2008, spam made up 70% of all e-mails sent. That’s 53.8 trillion a year – almost 37,000 spam e-mails per Internet user per year, or 101 per user per day.
  • Only about 20% of all e-mails originate from known legitimate servers.
  • Ferris Research estimates that spam will cost $130 billion worldwide in 2009.
  • Most computer viruses are now designed to hijack computers to send out spam – turning them into so-called spambots.
The Stranger Beside Me

Most computers on the Internet are unsecured home computers, and very vulnerable to being “taken over” and used to send spam. In 2007, Internet guru Vint Cerf estimated that up to 25% of computers on the Internet – 150 million of 600 million - could be spambots.

In 2008, the top 11 spammers alone were using over 1 million computers as spambots.

The spam industry has grown so complex and sophisticated that it contains syndicates whose only function is to infect and control computers, that they then hire out to spammers by the hour.

The Good News

  • The rate of growth in spam is levelling out and spam may even be declining as a percentage of total e-mails.
  • Spam filters are becoming more accurate, cutting down on spam that makes it through the filter, and on legitimate e-mails that don’t.
  • The cost of spam filters has dropped, and they are increasingly bundled with other valuable tools like antivirus, e-mail archiving and compliance tools.

What Does Spam Cost Businesses?


This message is starting to look a bit hackneyed, but spam yet again conforms to the general pattern for Total Cost of Ownership of IT (see Part 1 of this series), which is that most costs are indirect and are caused by lost productivity.

Most direct costs are borne by the ISPs

The “good” news is that most direct costs of spam are absorbed by ISPs, who need to have powerful anti-spam systems in place – but those costs are ultimately passed down to consumers in the form of higher prices.

Lost productivity is the stand-out cost of spam

Lost productivity is estimated to account for 85% of the total cost of spam to the average organization, according to Ferris Research.



The cost comes from working time spent identifying and deleting spam. Nucleus Research put this at U$712 per employee per year in 2007, Ferris at U$800 (4c per person per piece of spam).

The actual cost will depend on how many spam-e-mails a person receives per day; how long they spend on each; and what their time is worth.

Other effects of spam on productivity are:
  • False positives. Losing legitimate e-mails that are mistakenly labelled as spam and filtered out can cause significant delays and in some cases lost contracts or jobs.
  • Forrest Research estimate that it costs on average $3.50 per message to find an e-mail mistakenly trapped as spam.
  • Employees being duped into opening spam viruses that infect their computers.
  • Lost productivity from having an e-mail account blocked if a computer has been hijacked as a spambot, is sending spam and is blacklisted and blocked by the ISP.



Other costs of spam

Other costs of spam include:

  • Trickle-down costs from the ISPs (difficult to quantify)
  • Higher bandwidth costs
  • Support costs
  • Anti-spam technology (in-house or hosted)
  • Extra storage costs because of bigger mail volumes and quarantined spam

 
* Taken from Ferris Research estimates.


Spam Cost Calculators

There are quite a few spam calculators on the Web. Handle with care. Those published by companies selling anti-spam services could produce cost estimates that are unrealistically high.

We modelled our example above on Network World’s calculator. For the 50 employees in our hypothetical example above, the Comm Touch calculator estimated a cost of $41,063 per year in lost productivity, and Network Computing calculator put it at $31,335. Some of these differences are due to very different assumptions about extra storage needed.
 
Network World spam cost calculator

Network Computing spam cost calculator

Comm Touch spam cost calculator

Google cost calculator (in-house vs Google’s hosted anti-spam

Using an ISP to Filter Spam

In many cases, there’s precious little that businesses can do about spam. That’s because many smaller companies don’t have their own mail server. In those situations, the ISP is completely responsible for spam filtering. The good news is that they’re pretty good at it. The bad news is that they set their policies based on general needs, not individual customers’ specific ones.

Some ISPs (e.g. Rogers) allow clients to choose spam options – most importantly, whether suspect e-mails should be deleted before users see them, or whether they should be “quarantined” in a folder that users can review. Other suppliers, like Google, offer no choices.

Delete or Quarantine?

In terms of lost productivity, quarantining suspected spam e-mails (in a mailbox that can be reviewed by the end user) is about 60% less expensive than aggressive deleting (where the end user has no easy access to the deleted message).

Nucleus Research reports that it takes 1.6 times longer to look for lost, deleted messages than to review quarantined spam.

Applying that to our earlier example, where the average employee spent 10 minutes/week to review quarantined spam, the same employee would spend 16.2 minutes looking for lost deleted messages.

Let’s take a closer look at that for the hypothetical company from the table above:


In-House Mail Server: More Head-aches, But More Control

Businesses that have their own mail server may or may not need dedicated anti-spam technology, depending on how the mail server is set up. In some cases, e-mail still comes through the ISP, but generally it does not. In these cases, dedicated anti-spam technology is essential.

There are many good anti-spam options available. The biggest issue, both in choosing a solution and setting its parameters, is the constant trade-off between keeping out real spam and allowing legitimate e-mail in.

How do spam filters work?

Most spam filters use some combination of these techniques:

  • Keyword searches. E-mails containing predefined keywords are excluded.
  • Bayesian filtering. The spam filter keeps a list of words that have appeared in spam and non-spam messages, and can work out the probability, for a given word, that it is/isn’t spam - and from that, a probability for whole message. These systems “learn” over time.
  • “Honeypots”. These are fake e-mail addresses specifically designed to attract spam. The “trapped” messages are then filtered out and are not delivered.
  • Greylisting. The first time an e-mail arrives from an unknown computer, the recipient computer asks it to send again. Most spam e-mails are not resent; nearly all legitimate ones are. The resent e-mails are accepted and the sending computer is approved. Subsequent e-mails from that computer are allowed through on the first attempt.
  • Whitelisting. E-mails are only allowed in if the sender has been actively approved by the computer or user. This approach keeps out almost all spam, but is restrictive, time-intensive and likely to keep out legitimate e-mails from people who won’t bother to jump through the hoops.
  • Blacklisting. A number of organizations maintain blacklists of known spammers. These are circulated though the ISP community and e-mails from these sources are removed. The main problem with blacklists is ending up on one, usually through legitimate e-mail being mislabelled or when a computer is hijacked to send spam.

Hosted vs. in-house anti-spam

Dedicated anti-spam technology can be on-site or hosted. On-site technology can be installed on the mail server, or consist of a stand-alone device on the network.

Hosted solutions can be very cost-effective. Google has caused a stir with its $3/user/year hosted anti-spam and anti-virus service. That shaves $9/year off the typical $12/user/year, but as with many Google services, comes with limited support and no flexibility. The costs of hunting down lost legitimate e-mails could far outweigh the savings.

Advantages of hosted anti-spam:
  • Predictable costs regardless of amount of spam
  • No maintenance costs
  • Often more effective e-mail security

Disadvantages of hosted-anti-spam:
  • Little or no control over settings
  • Can be difficult or impossible to retrieve legitimate e-mails misidentified as spam.

Legitimate E-mail Marketing

Legitimate e-mail marketers constantly have to ensure that their mass e-mails aren’t mislabelled as spam and filtered out. Using e-mail best practices and legitimate providers will help optimize delivery rates. High-quality providers have an 88% delivery rate, compared with only 23% for spam.


Finally… A Brief History of Spam


This has nothing to do with making IT dollars count, but it’s interesting, and a good excuse to take a few minutes to watch Monty Python.

As the video demonstrates, the term “spam” means something that keeps repeating and repeating, and is extremely annoying.

The first spam-like e-mail was sent in 1978 when Einar Stefferud sent an e-mail to the entire West coast address list of ARPANET, the agency that developed the precursor of the Internet.

In the late 1980s, users of “multi-user dungeons”, or MUDs, an early version of the chat room, started to use the term “spamming” to refer to annoying behaviours, like crashing the database, producing large numbers of objects using automated software, and flooding chat sessions with large amounts of computer-generated text.

From 1994, the use of the term “spam” to refer to unsolicited commercial mass e-mails, and the actual practice of spamming, took off due to the untiring efforts of two tarnished immigration lawyers, a husband and wife team called Martha Siegel and Laurence Canter. Their “green card lottery” spam e-mail was the first large-scale use of junk e-mailing. Siegel and Cantor unapologetically defended the practice and actively promoted it, in the face of fierce opposition and legal challenges. In Internet lingo, “Siegel & Canter” evolved rapidly into “Spam & Coleslaw”.

The list below shows some milestones on the road from there to here – “there” being a new phenomenon that many immediately recognized as a threat to the Internet’s integrity and functionality; “here” being today’s Internet where spam dominates e-mail and costs well over a hundred billion dollars per year.

Some spam milestones

1978:    First unsolicited e-mail sent to large number of users (Einar Stefferud to ARPANET)
1982:    First e-mail chain letter
1991:    Craig Shergold e-mail chain letter
1993:    MAKE.MONEY.FAST spam chain letter
1994:    Siegel & Canter “Green Card Lottery” spam kick-starts the commercial spam era
1994:    Unsolicited junk e-mail widely known as “spam”
1994:    “Good Times Virus” e-mail hoax
1995 :   "Spamware" (spamming software) starts developing
1995:    abuse@ addresses created to report spam
1995:    List of 2 million email addresses offered for sale
2000:    Taiwan (.tw) becomes the spam capital of the world
2000:    Nigerian scam spam becomes infamous
2001:    List of 209 million email addresses offered for sale
2007:    25% of the 600 million computers on the Internet could be spambots.
2008:    Spam makes up 70% of all e-mails sent
2008:    Up to 25% of all computers could be being used as spambots
2009:    Spam predicted to cost $130 billion globally   

Sources

150 million bots

Calculating the true cost of fighting spam  

Canter & Siegel

Cost of Spam is Flattening — Our 2009 Predictions    

Cost optimization for e-mail infrastructures: Gartner ID G00164905 (2009)

E-mail marketing: best practices - Optin

E-mail marketing: best practices - MobileStorm

Internet 2008 in numbers

Keith Lynch's timeline of spam related terms and concepts

Origin of the term "spam" to mean net abuse

Return Path Q2 2008 (E-mail performance whitepaper)

Spam ROI: Profit on 1 in 12.5m Response Rate

Spam Costs Billions. The cost of spam in terms of lost productivity has reached $21.58 billion annually

Spam filter software to block spam

The Cost Impact of Spam Filters: Measuring the Effect of Information System Technologies in Organizations

The Cost Of The War On Spam

The Real Cost of Spam

What spam really costs, Part I

What spam really costs, Part II


Copyright 2006-2009 (C) Nash Networks Inc. All Rights Reserved.
Design and Development by Intelex