Tuesday, 6 January 2004
Spam still flowing
Jonathan Krim of the Washington Post reports that the flow of spam has not decreased since the beginning of the year ("Spam Is Still Flowing Into E-Mail Boxes"). Irresponsible journalism is rare in that paper; this is the only example of it I can recall in several years. Although he does not say so explicitly, Krim's tone throughout the article suggests that the CAN-SPAM Act is a failure. The main unstated assumption, of course, is that five days is sufficient for the Act to reduce spam in a measurable way (the Act became effective on 1 January).
Some reasons why this is irresponsible follow, in no particular order.
Assuming perfect compliance with CAN-SPAM, we should not expect to see any decrease in spam until 10 January. The Act became effective on 1 January and gives spammers a ten-day grace period to remove an address from a mailing list after receiving an opt-out request. Even 10 January is a ludicrously early date to measure CAN-SPAM's success because it assumes that a large number of people submitted opt-out requests on 1 January for spam that was sent on that day. (Spam and opt-out requests sent prior to the Act's effective date are not subject to its requirements.)
Even if it were reasonable to expect the law to have a measurable effect in "Internet time," the evidence that Krim presents in this article could not, even in principle, measure any effect. The "data" comes solely from an informal survey of executives from ISPs and email filtering companies. This is problematic for two reasons. First, anecdotes are not a valid basis for measuring empirical phenomena. Second, these anecdotes come from parties with obvious interests in the effect being measured. ISPs spend lots of money fighting spam and want to eliminate it entirely. Filtering companies sell services to ISPs and consumers. A widespread public perception that spam is a bigger problem than it really is will help ISPs lobby for stricter laws and help filtering companies sell more services. (I am not trying to minimize the spam problem here; I am merely pointing out a probable source of bias in the data presented.)
CAN-SPAM is designed to permit spam to be sent until the receiver opts out or unless the message is deceptive in one of several ways. Therefore, the overall volume of spam (measured at the ISP level, with no knowledge of opt-outs or deceptiveness) bears no relation to the Act's success or failure. Any ISP that claims it can differentiate between misleading spam and non-misleading spam — which several of Krim's interviewees did — has just admitted to reading its customers' email. I wonder whether they first secured permission from those customers?
Laws take time to be enforced properly. After the first case of mad cow disease was uncovered in the U.S., the media widely reported the enforcement problems that both the Clinton and Bush administrations faced with the rules restricting the types of feed that cattle were permitted to consume. Nearly a year after the rules were first implemented in 1997, the compliance rate was estimated at 50%. Five years later, the compliance rate was estimated at 97%. And cattle ranchers are people whom most of us would regard as forthright, upstanding citizens who generally try to comply with the law. Few of us can say the same about spammers — whose livelihood for years has depended on deception and evasiveness. Even if we equate spammers with cattle ranchers, we can look forward to a 50% reduction in illegal spam a year from now — to say nothing of the legal spam that will remain.
I have said many times that we should give CAN-SPAM a reasonable amount of time to work (1, 2, 3, 4, 5, 6, 7). I have said almost as many times that it will probably take one prosecution — either civil or criminal — before the level of spam will drop significantly.
I want spam to stop as much as the next guy. The CAN-SPAM Act is no silver bullet, but it is a reasonable first step. So stop whining and give it a chance to work!