Spam Inc.

Ryan Dong didn't set out to become a spammer. The 23-year-old college student from Pontiac, Michigan, started his professional life working for a dot com. When the Web bubble burst, he found himself out of work and out of prospects. The computer science undergrad decided to start his own business, a recruiting site called Havoc Jobs. He began to promote the site using e-mail. And then he had an inspiration--why not make e-mail the business instead?

So in May 2001, he and a partner set up a bulk e-mail service called Havoc Systems, offering server space and bandwidth to mass e-mailers. He posted an ad on a bulk mailer's forum; within days he had more business than he could handle.

In December, he started sending e-mail himself, charging $300 to $400 per million messages. Soon, he says, Havoc was sending 50 million pieces of spam a week. To buy time before Havoc's ISP shut him down, Dong split the mailings between his personal ISP accounts. When they got shuttered, he just signed up for new ones.

Dong began selling e-mail addresses (15 million names for $129) and set up a site where other spammers could swap targeted address lists. Now Havoc sells its own spamware, software tools that harvest addresses and manage lists.

In good times, Dong says, "I can pull in $100K a year or more." But he adds, "when the ISP pulls my connections, I make nothing." On the phone, he sounds tired of switching ISPs and trying to stay one step ahead of the antispammers; he insists, "We're not there to bother [spam recipients]. All they have to do is hit delete."

Dong's story illustrates how virtually anyone can get started in the spam trade. And that's why, though spam costs us billions of dollars each year, we can do little to cut off e-mail spam at its source.

Bulkers Banquet

We are in the midst of a spam epidemic. Depending on which survey you read, anywhere from 15 to 50 percent of e-mail messages consist of advertisements for miracle cures, financial scams, porn site come-ons, and other unsolicited commercial messages. According to e-mail filter vendor Brightmail, the number of spam attacks has risen by more than 500 percent since March 2001.

And in the next few years, the situation is going to get much, much worse. A study released last fall by Jupiter Media Metrix predicts that by 2006 a typical consumer can expect to receive nearly 1500 servings of spam annually--double the number that the average user gets today.

The time and data involved take an economic toll. Spam costs businesses worldwide some $8 billion to $10 billion per year in bandwidth charges alone, according to estimates by the European Union.

So why does spam remain a thriving business? I decided to find out--and I discovered that the only things you need to get started are a credit card, a computer, and an Internet connection.

My experience as a spammer started on the Web, searching for spamware--the software that spammers use to ply their trade. For about $50 a month, I joined two private online clubs for bulk e-mailers: Bulk Barn and Bulkers Club. Though neither site officially condones spam, both traffic in the tools that make it possible.

Once I was a member, I could buy all the tools I needed. First on my list was a bulk mailer, which sends a single e-mail message to thousands of people each minute. Etoyi Technology's Email Sender Express ($40) let me send a simple text message to a list of addresses--and falsify the return address. I also wanted a tool that stores any e-mail address it finds on the Web in a database. Beijing Express E-mail Address Extractor ($98) produced 1000 e-mail addresses in just 5 minutes. To get a list of open relay servers--insecurely configured machines that anyone can use to send e-mail messages anonymously--I subscribed to InfinityMailer ($75) and found free lists of open relays, most of them located in Asia, propagating terabytes of spam to the rest of the world.

Of course, spamware doesn't come with any guarantees. The software I used often crashed or failed to perform as advertised. And open relays and bulk hosts (servers that send massive amounts of e-mail) can vanish overnight. Sending mail in larger volumes than the few dozen I sent to willing colleagues requires a bigger investment and more technical know-how.